Package org.keycloak.broker.provider

Class TrustMaterialSdJwtIssuerResolver

java.lang.Object

org.keycloak.broker.provider.TrustMaterialSdJwtIssuerResolver

All Implemented Interfaces:

TrustedSdJwtIssuerResolver

public class TrustMaterialSdJwtIssuerResolver
extends Object
implements TrustedSdJwtIssuerResolver

Bridges a TrustMaterialIdentityProvider to a TrustedSdJwtIssuerResolver: it reads the issuer key hints (kid, alg, iss) from the credential's issuer signed JWT and looks up the matching trusted keys. TODO: This needs to be changed to either use the x5c-Header and do a Chain-Validation against a pre-configured cert / ETSI trust list (enforced in HAIP) OR look up the JWKS dynamically from .well-known/jwt-vc-issuer endpoint of the issuer in the credential

Constructor Summary

Constructors

Constructor	Description
TrustMaterialSdJwtIssuerResolver(TrustMaterialIdentityProvider<?> trustMaterial)

Method Summary

Modifier and Type	Method	Description
TrustedSdJwtIssuer	resolve(IssuerSignedJWT issuerSignedJwt)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

TrustMaterialSdJwtIssuerResolver

public TrustMaterialSdJwtIssuerResolver(TrustMaterialIdentityProvider<?> trustMaterial)

Method Details

resolve

public TrustedSdJwtIssuer resolve(IssuerSignedJWT issuerSignedJwt)
                           throws VerificationException

Specified by:

resolve in interface TrustedSdJwtIssuerResolver

Throws:

VerificationException