Package org.keycloak.broker.oid4vp

Class OID4VPIdentityProviderEndpoint

java.lang.Object

org.keycloak.broker.oid4vp.OID4VPIdentityProviderEndpoint

public class OID4VPIdentityProviderEndpoint
extends Object

JAX-RS endpoint backing the OID4VP wallet flow, routed at /realms/{realm}/broker/{alias}/endpoint.

• GET /request-object/{handle} serves the signed authorization request object.
• POST / receives the wallet's direct_post presentation, verifies it, and returns the browser redirect that finalizes login, or an empty JSON object for the cross device flow where the remote wallet cannot drive the browser.
• GET /status tells the polling login page whether the cross device presentation arrived.
• GET /complete-auth resolves the deferred identity and hands control back to Keycloak.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	COMPLETE_AUTH_PATH
static final String	FLOW_CROSS_DEVICE
static final String	FLOW_PARAM
static final String	REQUEST_OBJECT_PATH
static final String	STATUS_COMPLETE
static final String	STATUS_ERROR
static final String	STATUS_EXPIRED
static final String	STATUS_KEY
static final String	STATUS_PATH
static final String	STATUS_PENDING
static final String	STATUS_REDIRECT_URI_KEY

Constructor Summary

Constructors

Constructor	Description
OID4VPIdentityProviderEndpoint(KeycloakSession session, RealmModel realm, OID4VPIdentityProvider provider, UserAuthenticationIdentityProvider.AuthenticationCallback callback, EventBuilder event)

Method Summary

Modifier and Type	Method	Description
protected RequestObject	buildRequestObject(String state, RequestContext requestContext, boolean crossDevice)
jakarta.ws.rs.core.Response	completeAuth(String state, String responseCode)
protected String	completeAuthUrl(String state, String responseCode)
protected com.fasterxml.jackson.databind.JsonNode	dcqlQuery()
protected DecryptedResponse	decryptResponse(String response)
jakarta.ws.rs.core.Response	directPost(String vpToken, String state, String response, String flow)
static jakarta.ws.rs.core.UriBuilder	endpointBaseUri(jakarta.ws.rs.core.UriBuilder baseUriBuilder, String realmName, String alias)
protected static jakarta.ws.rs.core.Response	errorResponse(jakarta.ws.rs.core.Response.Status status, String error, String description)
protected static boolean	isCrossDevice(String flow)
protected jakarta.ws.rs.core.Response	loginError(jakarta.ws.rs.core.Response.Status status, String error, String description, String eventError)
protected jakarta.ws.rs.core.Response	loginErrorPage(AuthenticationSessionModel authSession, String messageKey)
jakarta.ws.rs.core.Response	requestObject(String state, String flow)
protected AuthenticationSessionModel	resolveAuthSession(String rootSessionId, String tabId)
protected String	responseUri(boolean crossDevice)
jakarta.ws.rs.core.Response	status(String state)
protected static jakarta.ws.rs.core.Response	statusResponse(jakarta.ws.rs.core.Response.Status httpStatus, String status, String redirectUri)
protected BrokeredIdentityContext	toBrokeredContext(SdJwtVpVerificationResult result, AuthenticationSessionModel authSession)
protected SdJwtVpVerificationResult	verifyPresentation(String vpToken, String nonce)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

REQUEST_OBJECT_PATH

public static final String REQUEST_OBJECT_PATH

See Also:

• Constant Field Values

COMPLETE_AUTH_PATH

public static final String COMPLETE_AUTH_PATH

See Also:

• Constant Field Values

STATUS_PATH

public static final String STATUS_PATH

See Also:

• Constant Field Values

FLOW_PARAM

public static final String FLOW_PARAM

See Also:

• Constant Field Values

FLOW_CROSS_DEVICE

public static final String FLOW_CROSS_DEVICE

See Also:

• Constant Field Values

STATUS_KEY

public static final String STATUS_KEY

See Also:

• Constant Field Values

STATUS_REDIRECT_URI_KEY

public static final String STATUS_REDIRECT_URI_KEY

See Also:

• Constant Field Values

STATUS_PENDING

public static final String STATUS_PENDING

See Also:

• Constant Field Values

STATUS_COMPLETE

public static final String STATUS_COMPLETE

See Also:

• Constant Field Values

STATUS_EXPIRED

public static final String STATUS_EXPIRED

See Also:

• Constant Field Values

STATUS_ERROR

public static final String STATUS_ERROR

See Also:

• Constant Field Values

Constructor Details

OID4VPIdentityProviderEndpoint

public OID4VPIdentityProviderEndpoint(KeycloakSession session,
 RealmModel realm,
 OID4VPIdentityProvider provider,
 UserAuthenticationIdentityProvider.AuthenticationCallback callback,
 EventBuilder event)

Method Details

requestObject

@GET
@Path("/request-object/{state}")
public jakarta.ws.rs.core.Response requestObject(@PathParam("state")
 String state,
 @QueryParam("flow")
 String flow)

directPost

@POST
@Path("/")
@Consumes("application/x-www-form-urlencoded")
public jakarta.ws.rs.core.Response directPost(@FormParam("vp_token")
 String vpToken,
 @FormParam("state")
 String state,
 @FormParam("response")
 String response,
 @QueryParam("flow")
 String flow)

status

@GET
@Path("/status")
@Produces("application/json")
public jakarta.ws.rs.core.Response status(@QueryParam("state")
 String state)

completeAuth

@GET
@Path("/complete-auth")
public jakarta.ws.rs.core.Response completeAuth(@QueryParam("state")
 String state,
 @QueryParam("response_code")
 String responseCode)

buildRequestObject

protected RequestObject buildRequestObject(String state,
 RequestContext requestContext,
 boolean crossDevice)

dcqlQuery

protected com.fasterxml.jackson.databind.JsonNode dcqlQuery()

decryptResponse

protected DecryptedResponse decryptResponse(String response)
                                     throws VerificationException

Throws:

VerificationException

verifyPresentation

protected SdJwtVpVerificationResult verifyPresentation(String vpToken,
 String nonce)
                                                throws VerificationException

Throws:

VerificationException

toBrokeredContext

protected BrokeredIdentityContext toBrokeredContext(SdJwtVpVerificationResult result,
 AuthenticationSessionModel authSession)

resolveAuthSession

protected AuthenticationSessionModel resolveAuthSession(String rootSessionId,
 String tabId)

endpointBaseUri

public static jakarta.ws.rs.core.UriBuilder endpointBaseUri(jakarta.ws.rs.core.UriBuilder baseUriBuilder,
 String realmName,
 String alias)

responseUri

protected String responseUri(boolean crossDevice)

isCrossDevice

protected static boolean isCrossDevice(String flow)

statusResponse

protected static jakarta.ws.rs.core.Response statusResponse(jakarta.ws.rs.core.Response.Status httpStatus,
 String status,
 String redirectUri)

completeAuthUrl

protected String completeAuthUrl(String state,
 String responseCode)

loginError

protected jakarta.ws.rs.core.Response loginError(jakarta.ws.rs.core.Response.Status status,
 String error,
 String description,
 String eventError)

loginErrorPage

protected jakarta.ws.rs.core.Response loginErrorPage(AuthenticationSessionModel authSession,
 String messageKey)

errorResponse

protected static jakarta.ws.rs.core.Response errorResponse(jakarta.ws.rs.core.Response.Status status,
 String error,
 String description)