Package org.keycloak.protocol.oid4vc.issuance.mappers

Class OID4VCSubjectIdMapper

java.lang.Object

org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCMapper

org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCSubjectIdMapper

All Implemented Interfaces:

OID4VCEnvironmentProviderFactory, ProtocolMapper, ConfiguredProvider, EnvironmentDependentProviderFactory, Provider, ProviderFactory<ProtocolMapper>

public class OID4VCSubjectIdMapper
extends OID4VCMapper

Sets an ID for the credential subject, either from User ID or by attribute mapping. The subject ID defaults to the user's username but can be configured to use email or internal ID.

Author:

Stefan Wiedemann

Field Summary

Fields

Modifier and Type	Field	Description
static final String	MAPPER_ID

Fields inherited from class org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCMapper

CLAIM_NAME, format, MAPPER_MISSING_MDOC_NAMESPACE_ERROR, MAPPER_RESERVED_CLAIM_ERROR, mapperModel, MDOC_NAMESPACE, USER_ATTRIBUTE_KEY

Constructor Summary

Constructors

Constructor	Description
OID4VCSubjectIdMapper()

Method Summary

Modifier and Type	Method	Description
static ProtocolMapperModel	create(String name, String claimName, String userAttribute)
ProtocolMapper	create(KeycloakSession session)
protected Set<String>	getAllowedReservedClaims()	Returns the reserved, issuer-controlled claims this mapper is allowed to write.
protected List<String>	getClaimLookupPath()	Returns the raw claim lookup path in the intermediate map populated by OID4VCMapper.setClaim(Map, UserSessionModel).
String	getDisplayType()
String	getHelpText()
String	getId()
protected List<ProviderConfigProperty>	getIndividualConfigProperties()
List<String>	getMetadataAttributePath()	Returns the externally visible claim path used in credential metadata and authorization_details validation.
protected String	resolveClaimName(ProtocolMapperModel mapperModel)	Resolves the effective claim name written by this mapper, based on the given configuration.
void	setClaim(Map<String,Object> claims, UserSessionModel userSessionModel)	Set the claims to the credential subject.
void	setClaim(VerifiableCredential verifiableCredential, UserSessionModel userSessionModel)	Set the claims to credential, like f.e. the context

Methods inherited from class org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCMapper

close, getAttributePrefix, getClaimLookupPath, getClaimName, getClaimName, getConfigProperties, getDisplayCategory, getMapperName, getMetadataAttributePath, getProtocol, includeInMetadata, init, passesMappingGuards, postInit, prefixMetadataAttributePath, setClaimWithMetadataPrefix, setMapperModel, supportsCredentialFormat, validate, validateAgainstSensitiveMappings, validateConfig, validateMdocNamespace

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.provider.ConfiguredProvider

getConfig

Methods inherited from interface org.keycloak.protocol.oid4vc.OID4VCEnvironmentProviderFactory

isSupported

Methods inherited from interface org.keycloak.protocol.ProtocolMapper

getEffectiveModel, getPriority

Methods inherited from interface org.keycloak.provider.ProviderFactory

dependsOn, getConfigMetadata, order

Field Details

MAPPER_ID

public static final String MAPPER_ID

See Also:

• Constant Field Values

Constructor Details

OID4VCSubjectIdMapper

public OID4VCSubjectIdMapper()

Method Details

create

public static ProtocolMapperModel create(String name,
 String claimName,
 String userAttribute)

getIndividualConfigProperties

protected List<ProviderConfigProperty> getIndividualConfigProperties()

Specified by:

getIndividualConfigProperties in class OID4VCMapper

setClaim

public void setClaim(VerifiableCredential verifiableCredential,
 UserSessionModel userSessionModel)

Description copied from class: OID4VCMapper

Set the claims to credential, like f.e. the context

Specified by:

setClaim in class OID4VCMapper

setClaim

public void setClaim(Map<String,Object> claims,
 UserSessionModel userSessionModel)

Description copied from class: OID4VCMapper

Set the claims to the credential subject.

Specified by:

setClaim in class OID4VCMapper

resolveClaimName

protected String resolveClaimName(ProtocolMapperModel mapperModel)

Description copied from class: OID4VCMapper

Resolves the effective claim name written by this mapper, based on the given configuration. Subclasses override this when they derive the claim name with a fallback (e.g. user attribute or a default claim name).

Overrides:

resolveClaimName in class OID4VCMapper

getMetadataAttributePath

public List<String> getMetadataAttributePath()

Description copied from class: OID4VCMapper

Returns the externally visible claim path used in credential metadata and authorization_details validation. JSON credentials use their normal credentialSubject/top-level paths; mDoc prepends the configured namespace because OID4VCI mDoc paths address namespace -> data element -> optional nested value.

Overrides:

getMetadataAttributePath in class OID4VCMapper

getClaimLookupPath

protected List<String> getClaimLookupPath()

Description copied from class: OID4VCMapper

Returns the raw claim lookup path in the intermediate map populated by OID4VCMapper.setClaim(Map, UserSessionModel). This is intentionally separate from OID4VCMapper.getMetadataAttributePath(): mDoc metadata paths add a namespace that is not present in the raw mapper output, and simple mappers may write a dotted claim name as one literal key.

Overrides:

getClaimLookupPath in class OID4VCMapper

getDisplayType

public String getDisplayType()

getHelpText

public String getHelpText()

create

public ProtocolMapper create(KeycloakSession session)

getAllowedReservedClaims

protected Set<String> getAllowedReservedClaims()

Description copied from class: OID4VCMapper

Returns the reserved, issuer-controlled claims this mapper is allowed to write. A mapper may only target a reserved claim listed here; every other reserved claim is rejected. Mappers are denied all reserved claims by default; subclasses that legitimately write a specific issuer-controlled claim (e.g. the generated-id mapper writing 'jti') override this to allow just that claim.

Overrides:

getAllowedReservedClaims in class OID4VCMapper

getId

public String getId()