Package org.keycloak.models.oid4vci

Class CredentialScopeModel

java.lang.Object
org.keycloak.models.oid4vci.CredentialScopeModel
All Implemented Interfaces:
ClientScopeModel, OrderedModel, ProtocolMapperContainerModel, ScopeContainerModel
public class CredentialScopeModel extends Object implements ClientScopeModel
This class acts as delegate for a ClientScopeModel implementation and adds additional functionality for OpenId4VC credentials
Author:
Pascal Knüppel

  • Field Details

    • CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT

      public static final String CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT
      See Also:

    • VC_BUILD_CONFIG_HASH_ALGORITHM_DEFAULT

      public static final String VC_BUILD_CONFIG_HASH_ALGORITHM_DEFAULT
      See Also:

    • VC_BUILD_CONFIG_SD_JWT_VISIBLE_CLAIMS_DEFAULT

      public static final String VC_BUILD_CONFIG_SD_JWT_VISIBLE_CLAIMS_DEFAULT
      See Also:

    • VC_BUILD_CONFIG_TOKEN_JWS_TYPE_DEFAULT

      public static final String VC_BUILD_CONFIG_TOKEN_JWS_TYPE_DEFAULT
      See Also:

    • VC_EXPIRY_IN_SECONDS_DEFAULT

      public static final Integer VC_EXPIRY_IN_SECONDS_DEFAULT

    • VC_FORMAT_DEFAULT

      public static final String VC_FORMAT_DEFAULT
      See Also:

    • VC_SD_JWT_NUMBER_OF_DECOYS_DEFAULT

      public static final Integer VC_SD_JWT_NUMBER_OF_DECOYS_DEFAULT

    • VC_CONFIGURATION_ID

      public static final String VC_CONFIGURATION_ID
      the credential configuration id as provided in the metadata endpoint
      See Also:

    • VC_IDENTIFIER

      public static final String VC_IDENTIFIER
      See Also:

    • VC_FORMAT

      public static final String VC_FORMAT
      See Also:

    • VC_EXPIRY_IN_SECONDS

      public static final String VC_EXPIRY_IN_SECONDS
      See Also:

    • VC_ISSUER_DID

      public static final String VC_ISSUER_DID
      See Also:

    • VCT

      public static final String VCT
      See Also:

    • VC_SUPPORTED_TYPES

      public static final String VC_SUPPORTED_TYPES
      the value that is added into the "types"-attribute of a verifiable credential
      See Also:

    • VC_CONTEXTS

      public static final String VC_CONTEXTS
      the value that is entered into the "@contexts"-attribute of a verifiable credential
      See Also:

    • VC_SIGNING_ALG

      public static final String VC_SIGNING_ALG
      The credential signature algorithm. If it is not configured, then the realm active key is used to sign the verifiable credential
      See Also:

    • VC_CRYPTOGRAPHIC_BINDING_METHODS

      public static final String VC_CRYPTOGRAPHIC_BINDING_METHODS
      if the credential is only meant for specific cryptographic binding algorithms the global default list can be overridden here. The global default list is retrieved from the available keys in the realm.
      See Also:

    • VC_SIGNING_KEY_ID

      public static final String VC_SIGNING_KEY_ID
      an optional configuration that can be used to select a specific key for signing the credential
      See Also:

    • VC_DISPLAY

      public static final String VC_DISPLAY
      an optional attribute for the metadata endpoint
      See Also:

    • VC_SD_JWT_NUMBER_OF_DECOYS

      public static final String VC_SD_JWT_NUMBER_OF_DECOYS
      this attribute holds a customizable value for the number of decoys to use in a SD-JWT credential
      See Also:

    • VC_BUILD_CONFIG_SD_JWT_VISIBLE_CLAIMS

      public static final String VC_BUILD_CONFIG_SD_JWT_VISIBLE_CLAIMS
      an optional attribute that tells us which attributes should be added into the SD-JWT body.
      See Also:

    • VC_BUILD_CONFIG_HASH_ALGORITHM

      public static final String VC_BUILD_CONFIG_HASH_ALGORITHM
      an optional configuration that can be used to select a specific hash algorithm
      See Also:

    • VC_BUILD_CONFIG_TOKEN_JWS_TYPE

      public static final String VC_BUILD_CONFIG_TOKEN_JWS_TYPE
      this attribute holds the 'typ' value that will be added into the JWS header of the credential.
      See Also:

    • VC_INCLUDE_IN_METADATA

      public static final String VC_INCLUDE_IN_METADATA
      this configuration property can be used to enforce specific claims to be included in the metadata, if they would normally not and vice versa
      See Also:

    • VC_KEY_ATTESTATION_REQUIRED

      public static final String VC_KEY_ATTESTATION_REQUIRED
      OPTIONAL. Object that describes the requirement for key attestations as described in Appendix D, which the Credential Issuer expects the Wallet to send within the proof(s) of the Credential Request. If the Credential Issuer does not require a key attestation, this parameter MUST NOT be present in the metadata. If both key_storage and user_authentication parameters are absent, the key_attestations_required parameter may be empty, indicating a key attestation is needed without additional constraints.
      See Also:

    • VC_KEY_ATTESTATION_REQUIRED_KEY_STORAGE

      public static final String VC_KEY_ATTESTATION_REQUIRED_KEY_STORAGE
      OPTIONAL. A non-empty array defining values specified in Appendix D.2 accepted by the Credential Issuer.
      See Also:

    • VC_KEY_ATTESTATION_REQUIRED_USER_AUTH

      public static final String VC_KEY_ATTESTATION_REQUIRED_USER_AUTH
      OPTIONAL. A non-empty array defining values specified in Appendix D.2 accepted by the Credential Issuer.
      See Also:

    • VC_BINDING_REQUIRED

      public static final String VC_BINDING_REQUIRED
      OPTIONAL. Flag that indicates whether cryptographic holder binding is REQUIRED for this credential configuration. If this flag is not set or set to false, the issuer metadata MUST omit the cryptographic_binding_methods_supported and proof_types_supported parameters for this configuration, meaning the wallet is not required to provide cryptographic key material or proofs.

      If true, the issuer metadata MUST include those parameters and the issuer MUST enforce the corresponding proof types during credential issuance, as per OID4VCI Section 12.2.4.

      See Also:

    • VC_BINDING_REQUIRED_PROOF_TYPES

      public static final String VC_BINDING_REQUIRED_PROOF_TYPES
      OPTIONAL. Comma-separated list of proof types that are REQUIRED for this credential configuration when VC_BINDING_REQUIRED is set to true. Example: "jwt,attestation".

      If VC_BINDING_REQUIRED is false or this attribute is empty/absent, no proof types are required and metadata MUST omit cryptographic_binding_methods_supported and proof_types_supported.

      See Also:

  • Constructor Details

    • CredentialScopeModel

      public CredentialScopeModel(ClientScopeModel clientScope)

  • Method Details