From 06f80416fb20c859ec6b057d973457d9af0608ae Mon Sep 17 00:00:00 2001
From: Akbar Husain <43771058+akbar1214@users.noreply.github.com>
Date: Thu, 14 Aug 2025 21:01:15 +0530
Subject: [PATCH] Replace keySet with entrySet

Closes #40064

Signed-off-by: akbarhusainpatel <apatel@intermiles.com>
Co-authored-by: akbarhusainpatel <apatel@intermiles.com>
---
 .../java/org/keycloak/common/Profile.java     |  5 ++--
 .../util/StringPropertyReplacerTest.java      |  6 ++---
 .../client/cli/config/RealmConfigData.java    |  5 ++--
 .../registration/cli/ReflectionUtil.java      |  3 +--
 .../datastore/DefaultMigrationManager.java    |  6 ++---
 .../saml/BaseSAML2BindingBuilder.java         |  4 +--
 .../core/saml/v2/util/StatementUtil.java      | 10 ++++----
 .../core/saml/v2/writers/BaseWriter.java      |  9 +++----
 .../core/util/NamespaceContext.java           |  6 ++---
 .../models/utils/RepresentationToModel.java   |  7 +++---
 .../userprofile/DefaultAttributes.java        |  5 ++--
 .../ClientRolesPartialImport.java             |  5 ++--
 .../partialimport/RolesPartialImport.java     | 25 +++++++++++--------
 .../oidc/endpoints/TokenEndpoint.java         |  4 +--
 .../endpoints/TokenIntrospectionEndpoint.java |  6 +++--
 .../endpoints/TokenRevocationEndpoint.java    |  4 +--
 .../oidc/grants/ciba/CibaGrantType.java       |  4 +--
 .../services/managers/CodeGenerateUtil.java   |  6 ++---
 .../keycloak/vault/VaultTranscriberTest.java  | 20 +++++++--------
 .../tests/admin/client/InstallationTest.java  |  4 +--
 .../java/org/keycloak/tests/utils/Assert.java |  7 +++---
 .../FailableHardcodedStorageProvider.java     |  6 ++---
 .../org/keycloak/testsuite/util/Timer.java    |  6 ++---
 .../java/org/keycloak/testsuite/Assert.java   |  7 +++---
 .../exportimport/ExportImportUtil.java        |  8 +++---
 .../util/cli/AbstractSessionCacheCommand.java |  8 +++---
 26 files changed, 97 insertions(+), 89 deletions(-)

diff --git a/common/src/main/java/org/keycloak/common/Profile.java b/common/src/main/java/org/keycloak/common/Profile.java
index 98d221932cb..51a959815b8 100755
--- a/common/src/main/java/org/keycloak/common/Profile.java
+++ b/common/src/main/java/org/keycloak/common/Profile.java
@@ -489,8 +489,9 @@ public class Profile {
     }
 
     private static void verifyConfig(Map<Feature, Boolean> features) {
-        for (Feature f : features.keySet()) {
-            if (features.get(f) && f.getDependencies() != null) {
+        for (Map.Entry<Feature, Boolean> entry : features.entrySet()) {
+            Feature f = entry.getKey();
+            if (entry.getValue() && f.getDependencies() != null) {
                 for (Feature d : f.getDependencies()) {
                     if (!features.get(d)) {
                         throw new ProfileException("Feature " + f.getKey() + " depends on disabled feature " + d.getKey());
diff --git a/common/src/test/java/org/keycloak/common/util/StringPropertyReplacerTest.java b/common/src/test/java/org/keycloak/common/util/StringPropertyReplacerTest.java
index fae57286741..3ccd6572ddf 100644
--- a/common/src/test/java/org/keycloak/common/util/StringPropertyReplacerTest.java
+++ b/common/src/test/java/org/keycloak/common/util/StringPropertyReplacerTest.java
@@ -72,10 +72,10 @@ public class StringPropertyReplacerTest {
     public void testEnvironmentVariables() throws NoSuchAlgorithmException {
         Map<String, String> env = System.getenv();
 
-        for (String key : env.keySet()) {
-            String value = env.get(key);
+        for (Map.Entry<String, String> entry : env.entrySet()) {
+            String value = entry.getValue();
             if ( !(value == null || "".equals(value)) ) {
-                Assert.assertEquals("foo-" + value, replaceProperties("foo-${env." + key + "}"));
+                Assert.assertEquals("foo-" + value, replaceProperties("foo-${env." + entry.getKey() + "}"));
                 break;
             }
         }
diff --git a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/config/RealmConfigData.java b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/config/RealmConfigData.java
index 6e1a73d0183..fdffa42e56d 100644
--- a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/config/RealmConfigData.java
+++ b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/config/RealmConfigData.java
@@ -179,8 +179,9 @@ public class RealmConfigData {
             if (clients == null) {
                 clients = source.clients;
             } else {
-                for (String key: source.clients.keySet()) {
-                    String val = source.clients.get(key);
+                for (var entry : source.clients.entrySet()) {
+                    String key = entry.getKey();
+                    String val = entry.getValue();
                     if (!"".equals(val)) {
                         clients.put(key, val);
                     } else {
diff --git a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/registration/cli/ReflectionUtil.java b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/registration/cli/ReflectionUtil.java
index 1e884884d0f..0f959e0a906 100644
--- a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/registration/cli/ReflectionUtil.java
+++ b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/registration/cli/ReflectionUtil.java
@@ -370,8 +370,7 @@ public class ReflectionUtil {
         // use setter on dest, and getter on source to copy value over
         Map<String, Field> fieldMap = getAttrFieldsForType(source.getClass());
         try {
-            for (String attrName : fieldMap.keySet()) {
-                Field field = fieldMap.get(attrName);
+            for (Field field : fieldMap.values()) {
                 Object localValue = field.get(source);
                 if (localValue != null) {
                     field.set(dest, localValue);
diff --git a/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultMigrationManager.java b/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultMigrationManager.java
index 229b6a2c60c..f6b8f90f3c2 100644
--- a/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultMigrationManager.java
+++ b/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultMigrationManager.java
@@ -223,9 +223,9 @@ public class DefaultMigrationManager implements MigrationManager {
 
     public static ModelVersion convertRHSSOVersionToKeycloakVersion(String version) {
         // look for the keycloakVersion pattern to identify it as RH SSO
-        for (Pattern pattern : PATTERN_MATCHER.keySet()) {
-            if (pattern.matcher(version).find()) {
-                return PATTERN_MATCHER.get(pattern);
+        for (var entry : PATTERN_MATCHER.entrySet()) {
+            if (entry.getKey().matcher(version).find()) {
+                return entry.getValue();
             }
         }
         // chceck if the version is in format for CD releases, e.g.: "keycloakVersion": "6"
diff --git a/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java b/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java
index 2d24cee1a7c..52dd0e9db21 100755
--- a/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java
+++ b/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java
@@ -419,8 +419,8 @@ public class BaseSAML2BindingBuilder<T extends BaseSAML2BindingBuilder> {
 
         builder.append("<p>Redirecting, please wait.</p>");
 
-        for (String key: inputTypes.keySet()) {
-            builder.append("<INPUT TYPE=\"HIDDEN\" NAME=\"").append(key).append("\"").append(" VALUE=\"").append(escapeAttribute(inputTypes.get(key))).append("\"/>");
+        for (var entry : inputTypes.entrySet()) {
+            builder.append("<INPUT TYPE=\"HIDDEN\" NAME=\"").append(entry.getKey()).append("\"").append(" VALUE=\"").append(escapeAttribute(entry.getValue())).append("\"/>");
         }
 
         builder.append("<NOSCRIPT>")
diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/StatementUtil.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/StatementUtil.java
index deb9bdbe997..32f9cd5c3f6 100755
--- a/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/StatementUtil.java
+++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/StatementUtil.java
@@ -85,8 +85,8 @@ public class StatementUtil {
 
         int i = 0;
 
-        Set<String> keys = attributes.keySet();
-        for (String key : keys) {
+        for (var entry : attributes.entrySet()) {
+            String key = entry.getKey();
             if (i == 0) {
                 // Deal with the X500 Profile of SAML2
                 attrStatement = new AttributeStatementType();
@@ -95,14 +95,14 @@ public class StatementUtil {
 
             // if the attribute contains roles, add each role as an attribute.
             if (AttributeConstants.ROLES.equalsIgnoreCase(key)) {
-                Object value = attributes.get(key);
+                Object value = entry.getValue();
                 if (value instanceof Collection<?>) {
                     Collection<?> roles = (Collection<?>) value;
                     attrStatement = createAttributeStatement(new ArrayList(roles));
                 }
             } else {
                 AttributeType att;
-                Object value = attributes.get(key);
+                Object value = entry.getValue();
 
                 String uri = X500SAMLProfileConstants.getOID(key);
                 if (StringUtil.isNotNull(uri)) {
@@ -233,4 +233,4 @@ public class StatementUtil {
         att.setNameFormat(JBossSAMLURIConstants.ATTRIBUTE_FORMAT_URI.get());
         return att;
     }
-}
\ No newline at end of file
+}
diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/writers/BaseWriter.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/writers/BaseWriter.java
index c5ca05eceea..8f39dafe963 100755
--- a/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/writers/BaseWriter.java
+++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/writers/BaseWriter.java
@@ -162,15 +162,14 @@ public class BaseWriter {
         if (otherAttribs != null) {
             List<String> nameSpacesDealt = new ArrayList<>();
 
-            Iterator<QName> keySet = otherAttribs.keySet().iterator();
-            while (keySet != null && keySet.hasNext()) {
-                QName qname = keySet.next();
+            for (var entry : otherAttribs.entrySet()) {
+                QName qname = entry.getKey();
                 String ns = qname.getNamespaceURI();
                 if (!nameSpacesDealt.contains(ns)) {
                     StaxUtil.writeNameSpace(writer, qname.getPrefix(), ns);
                     nameSpacesDealt.add(ns);
                 }
-                String attribValue = otherAttribs.get(qname);
+                String attribValue = entry.getValue();
                 StaxUtil.writeAttribute(writer, qname, attribValue);
             }
         }
@@ -392,4 +391,4 @@ public class BaseWriter {
     private void write(BaseIDAbstractType baseId) throws ProcessingException {
         throw logger.notImplementedYet("Method not implemented.");
     }
-}
\ No newline at end of file
+}
diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/util/NamespaceContext.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/util/NamespaceContext.java
index a5842866a6c..807ac8e356d 100755
--- a/saml-core/src/main/java/org/keycloak/saml/processing/core/util/NamespaceContext.java
+++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/util/NamespaceContext.java
@@ -61,10 +61,10 @@ public class NamespaceContext implements javax.xml.namespace.NamespaceContext {
      * @see javax.xml.namespace.NamespaceContext#getPrefix(java.lang.String)
      */
     public String getPrefix(String namespaceURI) {
-        for (String key : nsMap.keySet()) {
-            String value = nsMap.get(key);
+        for (var entry : nsMap.entrySet()) {
+            String value = entry.getValue();
             if (value.equals(namespaceURI)) {
-                return key;
+                return entry.getKey();
             }
         }
         return null;
diff --git a/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java b/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
index 6b8a7da1112..fe0bfbdab4e 100755
--- a/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
@@ -1541,9 +1541,8 @@ public class RepresentationToModel {
             Map<String, List<String>> attributes = resource.getAttributes();
 
             if (attributes != null) {
-                Set<String> existingAttrNames = existing.getAttributes().keySet();
 
-                for (String name : existingAttrNames) {
+                for (String name : existing.getAttributes().keySet()) {
                     if (attributes.containsKey(name)) {
                         existing.setAttribute(name, attributes.get(name));
                         attributes.remove(name);
@@ -1552,8 +1551,8 @@ public class RepresentationToModel {
                     }
                 }
 
-                for (String name : attributes.keySet()) {
-                    existing.setAttribute(name, attributes.get(name));
+                for (var entry : attributes.entrySet()) {
+                    existing.setAttribute(entry.getKey(), entry.getValue());
                 }
             }
 
diff --git a/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultAttributes.java b/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultAttributes.java
index 3dff11c42d9..14c8c300c6b 100644
--- a/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultAttributes.java
+++ b/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultAttributes.java
@@ -411,13 +411,14 @@ public class DefaultAttributes extends HashMap<String, List<String>> implements
         }
 
         // the profile should always hold all attributes defined in the config
-        for (String attributeName : metadataByAttribute.keySet()) {
+        for (var entry : metadataByAttribute.entrySet()) {
+            String attributeName = entry.getKey();
             if (!isSupportedAttribute(attributeName) || newAttributes.containsKey(attributeName)) {
                 continue;
             }
 
             List<String> values = EMPTY_VALUE;
-            AttributeMetadata metadata = metadataByAttribute.get(attributeName);
+            AttributeMetadata metadata = entry.getValue();
 
             if (user != null && isIncludeAttributeIfNotProvided(metadata)) {
                 values = user.getAttributes().getOrDefault(attributeName, EMPTY_VALUE);
diff --git a/services/src/main/java/org/keycloak/partialimport/ClientRolesPartialImport.java b/services/src/main/java/org/keycloak/partialimport/ClientRolesPartialImport.java
index b9b0ced5b3a..76334762dbb 100644
--- a/services/src/main/java/org/keycloak/partialimport/ClientRolesPartialImport.java
+++ b/services/src/main/java/org/keycloak/partialimport/ClientRolesPartialImport.java
@@ -114,14 +114,15 @@ public class ClientRolesPartialImport {
         Map<String, List<RoleRepresentation>> repList = getRepList(partialImportRep);
         if (repList == null || repList.isEmpty()) return;
 
-        for (String clientId : repList.keySet()) {
+        for (var entry : repList.entrySet()) {
+            String clientId = entry.getKey();
             if (!clientExists(partialImportRep, realm, clientId)) {
                 throw noClientFound(clientId);
             }
 
             toOverwrite.put(clientId, new HashSet<>());
             toSkip.put(clientId, new HashSet<>());
-            for (RoleRepresentation roleRep : repList.get(clientId)) {
+            for (RoleRepresentation roleRep : entry.getValue()) {
                 if (exists(realm, session, clientId, roleRep)) {
                     switch (partialImportRep.getPolicy()) {
                         case SKIP:
diff --git a/services/src/main/java/org/keycloak/partialimport/RolesPartialImport.java b/services/src/main/java/org/keycloak/partialimport/RolesPartialImport.java
index bbd127feb5f..b56e2c0338c 100644
--- a/services/src/main/java/org/keycloak/partialimport/RolesPartialImport.java
+++ b/services/src/main/java/org/keycloak/partialimport/RolesPartialImport.java
@@ -137,8 +137,8 @@ public class RolesPartialImport implements PartialImport<RolesRepresentation> {
     }
 
     private void setUniqueIds(Map<String, List<RoleRepresentation>> clientRoles) {
-        for (String clientId : clientRoles.keySet()) {
-            for (RoleRepresentation clientRole : clientRoles.get(clientId)) {
+        for (List<RoleRepresentation> roleRepresentations : clientRoles.values()) {
+            for (RoleRepresentation clientRole : roleRepresentations) {
                 clientRole.setId(KeycloakModelUtils.generateId());
             }
         }
@@ -162,8 +162,9 @@ public class RolesPartialImport implements PartialImport<RolesRepresentation> {
                                        RealmModel realm) {
         if (isEmpty(clientRolesToSkip)) return;
 
-        for (String clientId : clientRolesToSkip.keySet()) {
-            for (RoleRepresentation roleRep : clientRolesToSkip.get(clientId)) {
+        for (var entry : clientRolesToSkip.entrySet()) {
+            String clientId = entry.getKey();
+            for (RoleRepresentation roleRep : entry.getValue()) {
                 rep.getRoles().getClient().get(clientId).remove(roleRep);
                 String modelId = clientRolesPI.getModelId(realm, clientId);
                 results.addResult(clientRolesPI.skipped(clientId, modelId, roleRep));
@@ -191,9 +192,9 @@ public class RolesPartialImport implements PartialImport<RolesRepresentation> {
     private void deleteClientRoleOverwrites(RealmModel realm) {
         if (isEmpty(clientRolesToOverwrite)) return;
 
-        for (String clientId : clientRolesToOverwrite.keySet()) {
-            for (RoleRepresentation roleRep : clientRolesToOverwrite.get(clientId)) {
-                clientRolesPI.deleteRole(realm, clientId, roleRep);
+        for (var entry : clientRolesToOverwrite.entrySet()) {
+            for (RoleRepresentation roleRep : entry.getValue()) {
+                clientRolesPI.deleteRole(realm, entry.getKey(), roleRep);
             }
         }
     }
@@ -201,8 +202,9 @@ public class RolesPartialImport implements PartialImport<RolesRepresentation> {
     private void addResultsForOverwrittenClientRoles(PartialImportResults results, RealmModel realm) {
         if (isEmpty(clientRolesToOverwrite)) return;
 
-        for (String clientId : clientRolesToOverwrite.keySet()) {
-            for (RoleRepresentation roleRep : clientRolesToOverwrite.get(clientId)) {
+        for (var entry : clientRolesToOverwrite.entrySet()) {
+            String clientId = entry.getKey();
+            for (RoleRepresentation roleRep : entry.getValue()) {
                 String modelId = clientRolesPI.getModelId(realm, clientId);
                 results.addResult(clientRolesPI.overwritten(clientId, modelId, roleRep));
             }
@@ -238,8 +240,9 @@ public class RolesPartialImport implements PartialImport<RolesRepresentation> {
         if (!rep.hasClientRoles()) return;
 
         Map<String, List<RoleRepresentation>> repList = clientRolesPI.getRepList(rep);
-        for (String clientId : repList.keySet()) {
-            for (RoleRepresentation roleRep : repList.get(clientId)) {
+        for (var entry : repList.entrySet()) {
+            String clientId = entry.getKey();
+            for (RoleRepresentation roleRep : entry.getValue()) {
                 if (clientRolesToOverwrite.get(clientId).contains(roleRep)) continue;
                 if (clientRolesToSkip.get(clientId).contains(roleRep)) continue;
 
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java
index f8a0ac6e5c4..897dc7c4af9 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java
@@ -211,8 +211,8 @@ public class TokenEndpoint {
     }
 
     private void checkParameterDuplicated() {
-        for (String key : formParams.keySet()) {
-            if (formParams.get(key).size() != 1 && !grant.getSupportedMultivaluedRequestParameters().contains(key)) {
+        for (var entry : formParams.entrySet()) {
+            if (entry.getValue().size() != 1 && !grant.getSupportedMultivaluedRequestParameters().contains(entry.getKey())) {
                 throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "duplicated parameter",
                         Response.Status.BAD_REQUEST);
             }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenIntrospectionEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenIntrospectionEndpoint.java
index 908381a06cf..9c4e13b7c34 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenIntrospectionEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenIntrospectionEndpoint.java
@@ -40,6 +40,8 @@ import jakarta.ws.rs.core.MultivaluedMap;
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.Response.Status;
 
+import java.util.List;
+
 /**
  * A token introspection endpoint based on RFC-7662.
  *
@@ -150,8 +152,8 @@ public class TokenIntrospectionEndpoint {
 
 
     private void checkParameterDuplicated(MultivaluedMap<String, String> formParams) {
-        for (String key : formParams.keySet()) {
-            if (formParams.get(key).size() != 1) {
+        for (List<String> strings : formParams.values()) {
+            if (strings.size() != 1) {
                 throw throwErrorResponseException(Errors.INVALID_REQUEST, "duplicated parameter", Status.BAD_REQUEST);
             }
         }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java
index 79438475a89..8f7cbf8e325 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java
@@ -246,8 +246,8 @@ public class TokenRevocationEndpoint {
     }
 
     private void checkParameterDuplicated(MultivaluedMap<String, String> formParams) {
-        for (String key : formParams.keySet()) {
-            if (formParams.get(key).size() != 1) {
+        for (List<String> strings : formParams.values()) {
+            if (strings.size() != 1) {
                 throw new CorsErrorResponseException(cors, Errors.INVALID_REQUEST, "duplicated parameter", Response.Status.BAD_REQUEST);
             }
         }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantType.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantType.java
index b8537ec2f98..680250361f9 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantType.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantType.java
@@ -213,8 +213,8 @@ public class CibaGrantType extends OAuth2GrantTypeBase {
         authSession.setClientNote(OIDCLoginProtocol.ISSUER, Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
         authSession.setClientNote(OIDCLoginProtocol.SCOPE_PARAM, request.getScope());
         if (additionalParams != null) {
-            for (String paramName : additionalParams.keySet()) {
-                authSession.setClientNote(ADDITIONAL_CALLBACK_PARAMS_PREFIX + paramName, additionalParams.get(paramName));
+            for (var entry : additionalParams.entrySet()) {
+                authSession.setClientNote(ADDITIONAL_CALLBACK_PARAMS_PREFIX + entry.getKey(), entry.getValue());
             }
         }
         if (request.getOtherClaims() != null) {
diff --git a/services/src/main/java/org/keycloak/services/managers/CodeGenerateUtil.java b/services/src/main/java/org/keycloak/services/managers/CodeGenerateUtil.java
index 776c336a0c3..ea9e3320b14 100644
--- a/services/src/main/java/org/keycloak/services/managers/CodeGenerateUtil.java
+++ b/services/src/main/java/org/keycloak/services/managers/CodeGenerateUtil.java
@@ -59,9 +59,9 @@ class CodeGenerateUtil {
 
 
     static <CS extends CommonClientSessionModel> ClientSessionParser<CS> getParser(Class<CS> clientSessionClass) {
-        for (Class<?> c : PARSERS.keySet()) {
-            if (c.isAssignableFrom(clientSessionClass)) {
-                return PARSERS.get(c).get();
+        for (var entry : PARSERS.entrySet()) {
+            if (entry.getKey().isAssignableFrom(clientSessionClass)) {
+                return entry.getValue().get();
             }
         }
         return null;
diff --git a/services/src/test/java/org/keycloak/vault/VaultTranscriberTest.java b/services/src/test/java/org/keycloak/vault/VaultTranscriberTest.java
index 8fab2de9684..586b8b25008 100644
--- a/services/src/test/java/org/keycloak/vault/VaultTranscriberTest.java
+++ b/services/src/test/java/org/keycloak/vault/VaultTranscriberTest.java
@@ -74,9 +74,9 @@ public class VaultTranscriberTest {
 
         // attempt to obtain a secret using a proper vault expressions. The key may or may not exist in the vault, so we
         // check both cases using the returned optional and comparing against the expected secret.
-        for (String key : validExpressions.keySet()) {
-            String expectedSecret = validExpressions.get(key);
-            try (VaultRawSecret secret = transcriber.getRawSecret(key)) {
+        for (var entry : validExpressions.entrySet()) {
+            String expectedSecret = entry.getValue();
+            try (VaultRawSecret secret = transcriber.getRawSecret(entry.getKey())) {
                 Optional<ByteBuffer> optional = secret.get();
                 Optional<byte[]> optionalArray = secret.getAsArray();
                 if (expectedSecret != null) {
@@ -163,9 +163,9 @@ public class VaultTranscriberTest {
 
         // attempt to obtain a secret using a proper vault expressions. The key may or may not exist in the vault, so we
         // check both cases using the returned optional and comparing against the expected secret.
-        for (String key : validExpressions.keySet()) {
-            String expectedSecret = validExpressions.get(key);
-            try (VaultCharSecret secret = transcriber.getCharSecret(key)) {
+        for (var entry : validExpressions.entrySet()) {
+            String expectedSecret = entry.getValue();
+            try (VaultCharSecret secret = transcriber.getCharSecret(entry.getKey())) {
                 Optional<CharBuffer> optional = secret.get();
                 Optional<char[]> optionalArray = secret.getAsArray();
                 if (expectedSecret != null) {
@@ -249,9 +249,9 @@ public class VaultTranscriberTest {
 
         // attempt to obtain a secret using a proper vault expressions. The key may or may not exist in the vault, so we
         // check both cases using the returned optional and comparing against the expected secret.
-        for (String key : validExpressions.keySet()) {
-            String expectedSecret = validExpressions.get(key);
-            try (VaultStringSecret secret = transcriber.getStringSecret(key)) {
+        for (var entry : validExpressions.entrySet()) {
+            String expectedSecret = entry.getValue();
+            try (VaultStringSecret secret = transcriber.getStringSecret(entry.getKey())) {
                 Optional<String> optional = secret.get();
                 if (expectedSecret != null) {
                     Assert.assertTrue(optional.isPresent());
@@ -348,4 +348,4 @@ public class VaultTranscriberTest {
             // nothing to do
         }
     }
-}
\ No newline at end of file
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/InstallationTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/InstallationTest.java
index 0beda547a2e..8d2ed906293 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/client/InstallationTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/InstallationTest.java
@@ -396,8 +396,8 @@ public class InstallationTest {
         Node element = elementsByTagName.item(0);
 
         if (attrNamesAndValues != null) {
-            for (String attrName : attrNamesAndValues.keySet()) {
-                assertThat(element.getAttributes().getNamedItem(attrName).getNodeValue(), containsString(attrNamesAndValues.get(attrName)));
+            for (var entry : attrNamesAndValues.entrySet()) {
+                assertThat(element.getAttributes().getNamedItem(entry.getKey()).getNodeValue(), containsString(entry.getValue()));
             }
         }
     }
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/Assert.java b/tests/utils/src/main/java/org/keycloak/tests/utils/Assert.java
index efb264756b8..7d785eaf2ce 100644
--- a/tests/utils/src/main/java/org/keycloak/tests/utils/Assert.java
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/Assert.java
@@ -168,9 +168,10 @@ public class Assert extends Assertions {
 
     public static void assertRoleAttributes(Map<String, List<String>> expected, Map<String, List<String>> actual) {
         MatcherAssert.assertThat(actual.keySet(), equalTo(expected.keySet()));
-        for (String expectedKey : expected.keySet()) {
-            MatcherAssert.assertThat(actual.get(expectedKey).size(), is(equalTo(expected.get(expectedKey).size())));
-            MatcherAssert.assertThat(actual.get(expectedKey), containsInAnyOrder(expected.get(expectedKey).toArray()));
+        for (var entry : expected.entrySet()) {
+            String expectedKey = entry.getKey();
+            MatcherAssert.assertThat(actual.get(expectedKey).size(), is(equalTo(entry.getValue().size())));
+            MatcherAssert.assertThat(actual.get(expectedKey), containsInAnyOrder(entry.getValue().toArray()));
         }
     }
 }
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/FailableHardcodedStorageProvider.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/FailableHardcodedStorageProvider.java
index 90e52bbe524..2a6df132d88 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/FailableHardcodedStorageProvider.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/FailableHardcodedStorageProvider.java
@@ -193,10 +193,10 @@ public class FailableHardcodedStorageProvider implements UserStorageProvider, Us
         local.setLastName(last);
         local.setEmail(email);
         local.setFederationLink(model.getId());
-        for (String key : attributes.keySet()) {
-            List<String> values = attributes.get(key);
+        for (var entry : attributes.entrySet()) {
+            List<String> values = entry.getValue();
             if (values == null) continue;
-            local.setAttribute(key, values);
+            local.setAttribute(entry.getKey(), values);
         }
         return new Delegate(local);
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/Timer.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/Timer.java
index a625aad9d1a..50378c8be17 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/Timer.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/Timer.java
@@ -103,12 +103,12 @@ public class Timer {
     public void clearStats(boolean logStats, boolean saveData, boolean saveCharts) {
         if (logStats) {
             log.info("Timer Statistics:");
-            for (String op : stats.keySet()) {
+            for (var entry : stats.entrySet()) {
                 long sum = 0;
-                for (Long duration : stats.get(op)) {
+                for (Long duration : entry.getValue()) {
                     sum += duration;
                 }
-                log.info(String.format("Operation '%s' average: %s ms", op, sum / stats.get(op).size()));
+                log.info(String.format("Operation '%s' average: %s ms", entry.getKey(), sum / entry.getValue().size()));
             }
         }
         if (PROJECT_BUILD_DIRECTORY.exists()) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/Assert.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/Assert.java
index d84f94de6b7..52badde8df9 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/Assert.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/Assert.java
@@ -167,9 +167,10 @@ public class Assert extends org.junit.Assert {
 
     public static void assertRoleAttributes(Map<String, List<String>> expected, Map<String, List<String>> actual) {
         MatcherAssert.assertThat(actual.keySet(), equalTo(expected.keySet()));
-        for (String expectedKey : expected.keySet()) {
-            MatcherAssert.assertThat(actual.get(expectedKey).size(), is(equalTo(expected.get(expectedKey).size())));
-            MatcherAssert.assertThat(actual.get(expectedKey), containsInAnyOrder(expected.get(expectedKey).toArray()));
+        for (var entry : expected.entrySet()) {
+            String expectedKey = entry.getKey();
+            MatcherAssert.assertThat(actual.get(expectedKey).size(), is(equalTo(entry.getValue().size())));
+            MatcherAssert.assertThat(actual.get(expectedKey), containsInAnyOrder(entry.getValue().toArray()));
         }
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportUtil.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportUtil.java
index a2320af29f4..629ef53afaa 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportUtil.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportUtil.java
@@ -525,8 +525,8 @@ public class ExportImportUtil {
         Map<String, ClientMappingsRepresentation> clientRoles = client.getScopeMappings().getAll().getClientMappings();
         if (clientRoles == null) return clientScopeMappings;
 
-        for (String clientKey : clientRoles.keySet()) {
-            List<RoleRepresentation> clientRoleScopeMappings = clientRoles.get(clientKey).getMappings();
+        for (ClientMappingsRepresentation clientMappingsRepresentation : clientRoles.values()) {
+            List<RoleRepresentation> clientRoleScopeMappings = clientMappingsRepresentation.getMappings();
             if (clientRoleScopeMappings != null) clientScopeMappings.addAll(clientRoleScopeMappings);
         }
 
@@ -538,8 +538,8 @@ public class ExportImportUtil {
         Map<String, ClientMappingsRepresentation> clientRoles = client.getScopeMappings().getAll().getClientMappings();
         if (clientRoles == null) return clientScopeMappings;
 
-        for (String clientKey : clientRoles.keySet()) {
-            List<RoleRepresentation> clientRoleScopeMappings = clientRoles.get(clientKey).getMappings();
+        for (ClientMappingsRepresentation clientMappingsRepresentation : clientRoles.values()) {
+            List<RoleRepresentation> clientRoleScopeMappings = clientMappingsRepresentation.getMappings();
             if (clientRoleScopeMappings != null) clientScopeMappings.addAll(clientRoleScopeMappings);
         }
 
diff --git a/testsuite/utils/src/main/java/org/keycloak/testsuite/util/cli/AbstractSessionCacheCommand.java b/testsuite/utils/src/main/java/org/keycloak/testsuite/util/cli/AbstractSessionCacheCommand.java
index 1b83c4308fe..708d040f2f8 100644
--- a/testsuite/utils/src/main/java/org/keycloak/testsuite/util/cli/AbstractSessionCacheCommand.java
+++ b/testsuite/utils/src/main/java/org/keycloak/testsuite/util/cli/AbstractSessionCacheCommand.java
@@ -227,13 +227,13 @@ public abstract class AbstractSessionCacheCommand extends AbstractCommand {
 
         @Override
         protected void doRunCacheCommand(KeycloakSession session, Cache<String, SessionEntityWrapper> cache) {
-            for (String id : cache.keySet()) {
-                SessionEntity entity = cache.get(id).getEntity();
+            for (var entry : cache.entrySet()) {
+                SessionEntity entity = entry.getValue().getEntity();
                 if (!(entity instanceof UserSessionEntity)) {
                     continue;
                 }
-                UserSessionEntity userSession = (UserSessionEntity) cache.get(id).getEntity();
-                log.info("list: key=" + id + ", value=" + toString(userSession));
+                UserSessionEntity userSession = (UserSessionEntity) entry.getValue().getEntity();
+                log.info("list: key=" + entry.getKey() + ", value=" + toString(userSession));
             }
         }
     }