Package org.keycloak.broker.oid4vp

Class OID4VPIdentityProvider

java.lang.Object

org.keycloak.broker.provider.AbstractIdentityProvider<OID4VPIdentityProviderConfig>

org.keycloak.broker.oid4vp.OID4VPIdentityProvider

All Implemented Interfaces:

IdentityProvider<OID4VPIdentityProviderConfig>, TrustMaterialIdentityProvider<OID4VPIdentityProviderConfig>, UserAuthenticationIdentityProvider<OID4VPIdentityProviderConfig>, Provider

public class OID4VPIdentityProvider
extends AbstractIdentityProvider<OID4VPIdentityProviderConfig>
implements TrustMaterialIdentityProvider<OID4VPIdentityProviderConfig>

Identity provider that authenticates users with an OpenID4VP (OID4VP) wallet presentation.

Supports the same device and cross device flows with a single SD-JWT VC. performLogin(org.keycloak.broker.provider.AuthenticationRequest) renders a page with an openid4vp:// link for a wallet on this device and a QR code for a wallet on another device. The wallet fetches a signed request object and posts the presentation back to OID4VPIdentityProviderEndpoint, which verifies it and drives the normal broker machinery (existing or new user, first and post broker login). A remote wallet cannot redirect the browser, so the login page polls the endpoint until the presentation arrives.

The provider also acts as its own TrustMaterialIdentityProvider: the credential issuer signature is verified against the inline JWKS configured on this provider.

See Also:

• OID4VP 1.0

Nested Class Summary

Nested classes/interfaces inherited from interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider

UserAuthenticationIdentityProvider.AuthenticationCallback

Field Summary

Fields

Modifier and Type	Field	Description
static final List<String>	ACCEPTED_ALGORITHMS
static final String	CONTEXT_PREFIX
static final String	DEFERRED_PREFIX
static final String	IDENTITY_NOTE
static final String	KEY_CROSS_DEVICE
static final String	KEY_RESPONSE_CODE
static final String	KEY_ROOT_SESSION_ID
static final String	KEY_STATE
static final String	KEY_TAB_ID
static final int	QR_CODE_SIZE

Fields inherited from class org.keycloak.broker.provider.AbstractIdentityProvider

ACCOUNT_LINK_URL, BROKER_REGISTERED_NEW_USER, session, UPDATE_PROFILE_EMAIL_CHANGED, UPDATE_PROFILE_USERNAME_CHANGED

Fields inherited from interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider

EXTERNAL_IDENTITY_PROVIDER, FEDERATED_ACCESS_TOKEN

Constructor Summary

Constructors

Constructor	Description
OID4VPIdentityProvider(KeycloakSession session, OID4VPIdentityProviderConfig config)

Method Summary

Modifier and Type	Method	Description
protected String	buildWalletUrl(String clientId, URI requestUri)
Object	callback(RealmModel realm, UserAuthenticationIdentityProvider.AuthenticationCallback callback, EventBuilder event)	JAXRS callback endpoint for when the remote IDP wants to callback to keycloak.
String	clientId()
protected ClientIdentifier	clientIdentifier()
protected jakarta.ws.rs.core.UriBuilder	endpointUri(AuthenticationRequest request)
protected int	loginTimeoutSeconds()
jakarta.ws.rs.core.Response	performLogin(AuthenticationRequest request)	Initiates the authentication process by sending an authentication request to an identity provider.
protected URI	requestUri(AuthenticationRequest request, String state, boolean crossDevice)
Stream<JWK>	resolveKeys(TrustMaterialRequest request)
jakarta.ws.rs.core.Response	retrieveToken(KeycloakSession session, FederatedIdentityModel identity)	Returns a Response containing the token previously stored during the authentication process for a specific user.
jakarta.ws.rs.core.Response	retrieveToken(KeycloakSession session, FederatedIdentityModel identity, UserSessionModel userSession, UserModel user)	Returns a Response containing the token previously stored during the authentication process for a specific user.
KeyWrapper	signingKey()
protected String	statusUrl(AuthenticationRequest request, String state)
protected TrustedSdJwtIssuerResolver	trustedIssuerResolver()

Methods inherited from class org.keycloak.broker.provider.AbstractIdentityProvider

authenticationFinished, backchannelLogout, buildTokenResponse, close, exchangeErrorResponse, exchangeNotLinked, exchangeNotLinkedNoStore, exchangeNotSupported, exchangeTokenExpired, exchangeUnsupportedRequiredType, getConfig, getFederatedAccessToken, getFederatedAccessTokenKey, getFederatedTokenNote, getLinkingUrl, getMarshaller, importNewUser, keycloakInitiatedBrowserLogout, preprocessFederatedIdentity, setEmailVerified, setFederatedAccessToken, setFederatedAccessToken, updateBrokeredUser, updateEmail

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.broker.provider.IdentityProvider

export, getConfig, isMapperSupported, isType, reloadKeys

Methods inherited from interface org.keycloak.provider.Provider

close

Methods inherited from interface org.keycloak.broker.provider.TrustMaterialIdentityProvider

resolveX509Trust

Methods inherited from interface org.keycloak.broker.provider.UserAuthenticationIdentityProvider

supportsLongStateParameter

Field Details

ACCEPTED_ALGORITHMS

public static final List<String> ACCEPTED_ALGORITHMS

CONTEXT_PREFIX

public static final String CONTEXT_PREFIX

See Also:

• Constant Field Values

DEFERRED_PREFIX

public static final String DEFERRED_PREFIX

See Also:

• Constant Field Values

IDENTITY_NOTE

public static final String IDENTITY_NOTE

See Also:

• Constant Field Values

KEY_ROOT_SESSION_ID

public static final String KEY_ROOT_SESSION_ID

See Also:

• Constant Field Values

KEY_TAB_ID

public static final String KEY_TAB_ID

See Also:

• Constant Field Values

KEY_STATE

public static final String KEY_STATE

See Also:

• Constant Field Values

KEY_RESPONSE_CODE

public static final String KEY_RESPONSE_CODE

See Also:

• Constant Field Values

KEY_CROSS_DEVICE

public static final String KEY_CROSS_DEVICE

See Also:

• Constant Field Values

QR_CODE_SIZE

public static final int QR_CODE_SIZE

See Also:

• Constant Field Values

Constructor Details

OID4VPIdentityProvider

public OID4VPIdentityProvider(KeycloakSession session,
 OID4VPIdentityProviderConfig config)

Method Details

performLogin

public jakarta.ws.rs.core.Response performLogin(AuthenticationRequest request)

Description copied from interface: UserAuthenticationIdentityProvider

Initiates the authentication process by sending an authentication request to an identity provider. This method is called only once during the authentication.

Specified by:

performLogin in interface UserAuthenticationIdentityProvider<OID4VPIdentityProviderConfig>

Overrides:

performLogin in class AbstractIdentityProvider<OID4VPIdentityProviderConfig>

Parameters:

request - The initial authentication request. Contains all the contextual information in order to build an authentication request to the identity provider.

Returns:

callback

public Object callback(RealmModel realm,
 UserAuthenticationIdentityProvider.AuthenticationCallback callback,
 EventBuilder event)

Description copied from interface: UserAuthenticationIdentityProvider

JAXRS callback endpoint for when the remote IDP wants to callback to keycloak.

Specified by:

callback in interface UserAuthenticationIdentityProvider<OID4VPIdentityProviderConfig>

Overrides:

callback in class AbstractIdentityProvider<OID4VPIdentityProviderConfig>

Returns:

resolveKeys

public Stream<JWK> resolveKeys(TrustMaterialRequest request)

Specified by:

resolveKeys in interface TrustMaterialIdentityProvider<OID4VPIdentityProviderConfig>

trustedIssuerResolver

protected TrustedSdJwtIssuerResolver trustedIssuerResolver()

retrieveToken

public jakarta.ws.rs.core.Response retrieveToken(KeycloakSession session,
 FederatedIdentityModel identity)

Description copied from interface: UserAuthenticationIdentityProvider

Returns a Response containing the token previously stored during the authentication process for a specific user. Deprecated method used for Identity Brokering API V1 that only uses the database.

Specified by:

retrieveToken in interface UserAuthenticationIdentityProvider<OID4VPIdentityProviderConfig>

Returns:

retrieveToken

public jakarta.ws.rs.core.Response retrieveToken(KeycloakSession session,
 FederatedIdentityModel identity,
 UserSessionModel userSession,
 UserModel user)

Description copied from interface: UserAuthenticationIdentityProvider

Returns a Response containing the token previously stored during the authentication process for a specific user. This method looks in the user session and in the database if not present.

Specified by:

retrieveToken in interface UserAuthenticationIdentityProvider<OID4VPIdentityProviderConfig>

Returns:

signingKey

public KeyWrapper signingKey()

clientIdentifier

protected ClientIdentifier clientIdentifier()

clientId

public String clientId()

requestUri

protected URI requestUri(AuthenticationRequest request,
 String state,
 boolean crossDevice)

statusUrl

protected String statusUrl(AuthenticationRequest request,
 String state)

endpointUri

protected jakarta.ws.rs.core.UriBuilder endpointUri(AuthenticationRequest request)

buildWalletUrl

protected String buildWalletUrl(String clientId,
 URI requestUri)

loginTimeoutSeconds

protected int loginTimeoutSeconds()