Package org.keycloak.models.oid4vci

Class CredentialScopeModel

java.lang.Object

org.keycloak.models.oid4vci.CredentialScopeModel

All Implemented Interfaces:

ClientScopeModel, OrderedModel, ProtocolMapperContainerModel, ScopeContainerModel

public class CredentialScopeModel
extends Object
implements ClientScopeModel

This class acts as delegate for a ClientScopeModel implementation and adds additional functionality for OpenId4VC credentials

Author:

Pascal Knüppel

Nested Class Summary

Nested classes/interfaces inherited from interface org.keycloak.models.ClientScopeModel

ClientScopeModel.ClientScopeCreatedEvent, ClientScopeModel.ClientScopeRemovedEvent

Nested classes/interfaces inherited from interface org.keycloak.models.OrderedModel

OrderedModel.OrderedModelComparator<OM extends OrderedModel>

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CONFIGURATION_ID
static final String	CONTEXTS	the value that is entered into the "@contexts"-attribute of a verifiable credential
static final String	CREDENTIAL_IDENTIFIER
static final String	CRYPTOGRAPHIC_BINDING_METHODS	if the credential is only meant for specific cryptographic binding algorithms the global default list can be overridden here.
static final String	CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT
static final String	EXPIRY_IN_SECONDS
static final int	EXPIRY_IN_SECONDS_DEFAULT
static final String	FORMAT
static final String	FORMAT_DEFAULT
static final String	HASH_ALGORITHM	an optional configuration that can be used to select a specific hash algorithm
static final String	HASH_ALGORITHM_DEFAULT
static final String	INCLUDE_IN_METADATA	this configuration property can be used to enforce specific claims to be included in the metadata, if they would normally not and vice versa
static final String	ISSUER_DID	the credential configuration id as provided in the metadata endpoint
static final String	KEY_ATTESTATION_REQUIRED	OPTIONAL.
static final String	KEY_ATTESTATION_REQUIRED_KEY_STORAGE	OPTIONAL.
static final String	KEY_ATTESTATION_REQUIRED_USER_AUTH	OPTIONAL.
static final int	SD_JWT_DECOYS_DEFAULT
static final String	SD_JWT_NUMBER_OF_DECOYS	this attribute holds a customizable value for the number of decoys to use in a SD-JWT credential
static final String	SD_JWT_VISIBLE_CLAIMS	an optional attribute that tells us which attributes should be added into the SD-JWT body.
static final String	SD_JWT_VISIBLE_CLAIMS_DEFAULT
static final String	SIGNING_ALG	The credential signature algorithm.
static final String	SIGNING_KEY_ID	an optional configuration that can be used to select a specific key for signing the credential
static final String	TOKEN_JWS_TYPE	this attribute holds the 'typ' value that will be added into the JWS header of the credential.
static final String	TOKEN_TYPE_DEFAULT
static final String	TYPES	the value that is added into the "types"-attribute of a verifiable credential
static final String	VC_DISPLAY	an optional attribute for the metadata endpoint
static final String	VCT

Fields inherited from interface org.keycloak.models.ClientScopeModel

CONSENT_SCREEN_TEXT, DISPLAY_ON_CONSENT_SCREEN, DYNAMIC_SCOPE_REGEXP, GUI_ORDER, INCLUDE_IN_OPENID_PROVIDER_METADATA, INCLUDE_IN_TOKEN_SCOPE, IS_DYNAMIC_SCOPE, VALUE_SEPARATOR

Constructor Summary

Constructors

Constructor	Description
CredentialScopeModel(ClientScopeModel clientScope)

Method Summary

Modifier and Type	Method	Description
ProtocolMapperModel	addProtocolMapper(ProtocolMapperModel model)
void	addScopeMapping(RoleModel role)
void	deleteScopeMapping(RoleModel role)
String	getAttribute(String name)
Map<String,String>	getAttributes()
String	getConsentScreenText()
String	getCredentialConfigurationId()
String	getCredentialIdentifier()
List<String>	getCryptographicBindingMethods()
String	getDescription()
String	getDynamicScopeRegexp()
Integer	getExpiryInSeconds()
String	getFormat()
String	getGuiOrder()
String	getHashAlgorithm()
String	getId()
String	getIssuerDid()
String	getName()
Stream<Oid4vcProtocolMapperModel>	getOid4vcProtocolMappersStream()
String	getProtocol()
ProtocolMapperModel	getProtocolMapperById(String id)
ProtocolMapperModel	getProtocolMapperByName(String protocol, String name)
List<ProtocolMapperModel>	getProtocolMapperByType(String type)
Stream<ProtocolMapperModel>	getProtocolMappersStream()	Returns protocol mappers as a stream.
RealmModel	getRealm()
Stream<RoleModel>	getRealmScopeMappingsStream()	From the scope mappings returned by ScopeContainerModel.getScopeMappingsStream() returns only those that belong to the realm that owns this scope container.
List<String>	getRequiredKeyAttestationKeyStorage()
List<String>	getRequiredKeyAttestationUserAuthentication()
void	getRequiredKeyAttestationUserAuthentication(List<String> userAuthentication)
String	getScope()
Stream<RoleModel>	getScopeMappingsStream()	Returns scope mappings for this scope container as a stream.
int	getSdJwtNumberOfDecoys()
List<String>	getSdJwtVisibleClaims()
String	getSigningAlg()
String	getSigningKeyId()
List<String>	getSupportedCredentialTypes()
String	getTokenJwsType()
List<String>	getVcContexts()
String	getVcDisplay()
String	getVct()
boolean	hasDirectScope(RoleModel role)	Returns true, if this object has the given role directly in its scope.
boolean	hasScope(RoleModel role)	Returns true, if this object has the given role directly or indirectly in its scope, false otherwise.
boolean	isDisplayOnConsentScreen()
boolean	isDynamicScope()
boolean	isIncludeInTokenScope()
boolean	isKeyAttestationRequired()
void	removeAttribute(String name)
void	removeProtocolMapper(ProtocolMapperModel mapping)
void	setAttribute(String name, String value)
void	setConsentScreenText(String consentScreenText)
void	setCredentialConfigurationId(String credentialConfigurationId)
void	setCredentialIdentifier(String credentialIdentifier)
void	setCryptographicBindingMethods(String cryptographicBindingMethods)
void	setCryptographicBindingMethods(List<String> cryptographicBindingMethods)
void	setDescription(String description)
void	setDisplayOnConsentScreen(boolean displayOnConsentScreen)
void	setExpiryInSeconds(Integer expiryInSeconds)
void	setFormat(String credentialFormat)
void	setGuiOrder(String guiOrder)
void	setHashAlgorithm(String hashAlgorithm)
void	setIncludeInTokenScope(boolean includeInTokenScope)
void	setIsDynamicScope(boolean isDynamicScope)
void	setIssuerDid(String issuerDid)
void	setKeyAttestationRequired(boolean keyAttestationRequired)
void	setName(String name)
void	setProtocol(String protocol)
void	setRequiredKeyAttestationKeyStorage(List<String> keyStorage)
void	setSdJwtNumberOfDecoys(Integer sdJwtNumberOfDecoys)
void	setSdJwtVisibleClaims(String sdJwtVisibleClaims)
void	setSdJwtVisibleClaims(List<String> sdJwtVisibleClaims)
void	setSigningAlg(String signingAlg)
void	setSigningKeyId(String signingKeyId)
void	setSupportedCredentialTypes(String supportedCredentialTypes)
void	setSupportedCredentialTypes(List<String> supportedCredentialTypes)
void	setTokenJwsType(String tokenJwsType)
void	setVcContexts(String vcContexts)
void	setVcContexts(List<String> vcContexts)
void	setVcDisplay(String vcDisplay)
void	setVct(String vct)
void	updateProtocolMapper(ProtocolMapperModel mapping)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.models.ClientScopeModel

isIncludeInOpenIDProviderMetadata, setIncludeInOpenIDProviderMetadata

Field Details

SD_JWT_VISIBLE_CLAIMS_DEFAULT

public static final String SD_JWT_VISIBLE_CLAIMS_DEFAULT

See Also:

• Constant Field Values

SD_JWT_DECOYS_DEFAULT

public static final int SD_JWT_DECOYS_DEFAULT

See Also:

• Constant Field Values

FORMAT_DEFAULT

public static final String FORMAT_DEFAULT

See Also:

• Constant Field Values

HASH_ALGORITHM_DEFAULT

public static final String HASH_ALGORITHM_DEFAULT

See Also:

• Constant Field Values

TOKEN_TYPE_DEFAULT

public static final String TOKEN_TYPE_DEFAULT

See Also:

• Constant Field Values

EXPIRY_IN_SECONDS_DEFAULT

public static final int EXPIRY_IN_SECONDS_DEFAULT

See Also:

• Constant Field Values

CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT

public static final String CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT

See Also:

• Constant Field Values

ISSUER_DID

public static final String ISSUER_DID

the credential configuration id as provided in the metadata endpoint

See Also:

• Constant Field Values

CONFIGURATION_ID

public static final String CONFIGURATION_ID

See Also:

• Constant Field Values

CREDENTIAL_IDENTIFIER

public static final String CREDENTIAL_IDENTIFIER

See Also:

• Constant Field Values

FORMAT

public static final String FORMAT

See Also:

• Constant Field Values

EXPIRY_IN_SECONDS

public static final String EXPIRY_IN_SECONDS

See Also:

• Constant Field Values

VCT

public static final String VCT

See Also:

• Constant Field Values

TYPES

public static final String TYPES

the value that is added into the "types"-attribute of a verifiable credential

See Also:

• Constant Field Values

CONTEXTS

public static final String CONTEXTS

the value that is entered into the "@contexts"-attribute of a verifiable credential

See Also:

• Constant Field Values

SIGNING_ALG

public static final String SIGNING_ALG

The credential signature algorithm. If it is not configured, then the realm active key is used to sign the verifiable credential

See Also:

• Constant Field Values

CRYPTOGRAPHIC_BINDING_METHODS

public static final String CRYPTOGRAPHIC_BINDING_METHODS

if the credential is only meant for specific cryptographic binding algorithms the global default list can be overridden here. The global default list is retrieved from the available keys in the realm.

See Also:

• Constant Field Values

SIGNING_KEY_ID

public static final String SIGNING_KEY_ID

an optional configuration that can be used to select a specific key for signing the credential

See Also:

• Constant Field Values

VC_DISPLAY

public static final String VC_DISPLAY

an optional attribute for the metadata endpoint

See Also:

• Constant Field Values

SD_JWT_NUMBER_OF_DECOYS

public static final String SD_JWT_NUMBER_OF_DECOYS

this attribute holds a customizable value for the number of decoys to use in a SD-JWT credential

See Also:

• Constant Field Values

SD_JWT_VISIBLE_CLAIMS

public static final String SD_JWT_VISIBLE_CLAIMS

an optional attribute that tells us which attributes should be added into the SD-JWT body.

See Also:

• Constant Field Values

HASH_ALGORITHM

public static final String HASH_ALGORITHM

an optional configuration that can be used to select a specific hash algorithm

See Also:

• Constant Field Values

TOKEN_JWS_TYPE

public static final String TOKEN_JWS_TYPE

this attribute holds the 'typ' value that will be added into the JWS header of the credential.

See Also:

• Constant Field Values

INCLUDE_IN_METADATA

public static final String INCLUDE_IN_METADATA

this configuration property can be used to enforce specific claims to be included in the metadata, if they would normally not and vice versa

See Also:

• Constant Field Values

KEY_ATTESTATION_REQUIRED

public static final String KEY_ATTESTATION_REQUIRED

OPTIONAL. Object that describes the requirement for key attestations as described in Appendix D, which the Credential Issuer expects the Wallet to send within the proof(s) of the Credential Request. If the Credential Issuer does not require a key attestation, this parameter MUST NOT be present in the metadata. If both key_storage and user_authentication parameters are absent, the key_attestations_required parameter may be empty, indicating a key attestation is needed without additional constraints.

See Also:

• Constant Field Values

KEY_ATTESTATION_REQUIRED_KEY_STORAGE

public static final String KEY_ATTESTATION_REQUIRED_KEY_STORAGE

OPTIONAL. A non-empty array defining values specified in Appendix D.2 accepted by the Credential Issuer.

See Also:

• Constant Field Values

KEY_ATTESTATION_REQUIRED_USER_AUTH

public static final String KEY_ATTESTATION_REQUIRED_USER_AUTH

OPTIONAL. A non-empty array defining values specified in Appendix D.2 accepted by the Credential Issuer.

See Also:

• Constant Field Values

Constructor Details

CredentialScopeModel

public CredentialScopeModel(ClientScopeModel clientScope)

Method Details

getIssuerDid

public String getIssuerDid()

setIssuerDid

public void setIssuerDid(String issuerDid)

getScope

public String getScope()

getCredentialConfigurationId

public String getCredentialConfigurationId()

setCredentialConfigurationId

public void setCredentialConfigurationId(String credentialConfigurationId)

getCredentialIdentifier

public String getCredentialIdentifier()

setCredentialIdentifier

public void setCredentialIdentifier(String credentialIdentifier)

getFormat

public String getFormat()

setFormat

public void setFormat(String credentialFormat)

getExpiryInSeconds

public Integer getExpiryInSeconds()

setExpiryInSeconds

public void setExpiryInSeconds(Integer expiryInSeconds)

getSdJwtNumberOfDecoys

public int getSdJwtNumberOfDecoys()

setSdJwtNumberOfDecoys

public void setSdJwtNumberOfDecoys(Integer sdJwtNumberOfDecoys)

getVct

public String getVct()

setVct

public void setVct(String vct)

getTokenJwsType

public String getTokenJwsType()

setTokenJwsType

public void setTokenJwsType(String tokenJwsType)

getSigningKeyId

public String getSigningKeyId()

setSigningKeyId

public void setSigningKeyId(String signingKeyId)

getHashAlgorithm

public String getHashAlgorithm()

setHashAlgorithm

public void setHashAlgorithm(String hashAlgorithm)

getSupportedCredentialTypes

public List<String> getSupportedCredentialTypes()

setSupportedCredentialTypes

public void setSupportedCredentialTypes(String supportedCredentialTypes)

setSupportedCredentialTypes

public void setSupportedCredentialTypes(List<String> supportedCredentialTypes)

getVcContexts

public List<String> getVcContexts()

setVcContexts

public void setVcContexts(String vcContexts)

setVcContexts

public void setVcContexts(List<String> vcContexts)

getSigningAlg

public String getSigningAlg()

setSigningAlg

public void setSigningAlg(String signingAlg)

getCryptographicBindingMethods

public List<String> getCryptographicBindingMethods()

setCryptographicBindingMethods

public void setCryptographicBindingMethods(String cryptographicBindingMethods)

setCryptographicBindingMethods

public void setCryptographicBindingMethods(List<String> cryptographicBindingMethods)

getSdJwtVisibleClaims

public List<String> getSdJwtVisibleClaims()

setSdJwtVisibleClaims

public void setSdJwtVisibleClaims(String sdJwtVisibleClaims)

setSdJwtVisibleClaims

public void setSdJwtVisibleClaims(List<String> sdJwtVisibleClaims)

getVcDisplay

public String getVcDisplay()

setVcDisplay

public void setVcDisplay(String vcDisplay)

isKeyAttestationRequired

public boolean isKeyAttestationRequired()

setKeyAttestationRequired

public void setKeyAttestationRequired(boolean keyAttestationRequired)

getRequiredKeyAttestationKeyStorage

public List<String> getRequiredKeyAttestationKeyStorage()

setRequiredKeyAttestationKeyStorage

public void setRequiredKeyAttestationKeyStorage(List<String> keyStorage)

getRequiredKeyAttestationUserAuthentication

public List<String> getRequiredKeyAttestationUserAuthentication()

getRequiredKeyAttestationUserAuthentication

public void getRequiredKeyAttestationUserAuthentication(List<String> userAuthentication)

getId

public String getId()

Specified by:

getId in interface ClientScopeModel

getName

public String getName()

Specified by:

getName in interface ClientScopeModel

setName

public void setName(String name)

Specified by:

setName in interface ClientScopeModel

getRealm

public RealmModel getRealm()

Specified by:

getRealm in interface ClientScopeModel

getDescription

public String getDescription()

Specified by:

getDescription in interface ClientScopeModel

setDescription

public void setDescription(String description)

Specified by:

setDescription in interface ClientScopeModel

getProtocol

public String getProtocol()

Specified by:

getProtocol in interface ClientScopeModel

setProtocol

public void setProtocol(String protocol)

Specified by:

setProtocol in interface ClientScopeModel

setAttribute

public void setAttribute(String name,
 String value)

Specified by:

setAttribute in interface ClientScopeModel

removeAttribute

public void removeAttribute(String name)

Specified by:

removeAttribute in interface ClientScopeModel

getAttribute

public String getAttribute(String name)

Specified by:

getAttribute in interface ClientScopeModel

getAttributes

public Map<String,String> getAttributes()

Specified by:

getAttributes in interface ClientScopeModel

isDisplayOnConsentScreen

public boolean isDisplayOnConsentScreen()

Specified by:

isDisplayOnConsentScreen in interface ClientScopeModel

setDisplayOnConsentScreen

public void setDisplayOnConsentScreen(boolean displayOnConsentScreen)

Specified by:

setDisplayOnConsentScreen in interface ClientScopeModel

getConsentScreenText

public String getConsentScreenText()

Specified by:

getConsentScreenText in interface ClientScopeModel

setConsentScreenText

public void setConsentScreenText(String consentScreenText)

Specified by:

setConsentScreenText in interface ClientScopeModel

getGuiOrder

public String getGuiOrder()

Specified by:

getGuiOrder in interface ClientScopeModel

Specified by:

getGuiOrder in interface OrderedModel

setGuiOrder

public void setGuiOrder(String guiOrder)

Specified by:

setGuiOrder in interface ClientScopeModel

isIncludeInTokenScope

public boolean isIncludeInTokenScope()

Specified by:

isIncludeInTokenScope in interface ClientScopeModel

setIncludeInTokenScope

public void setIncludeInTokenScope(boolean includeInTokenScope)

Specified by:

setIncludeInTokenScope in interface ClientScopeModel

isDynamicScope

public boolean isDynamicScope()

Specified by:

isDynamicScope in interface ClientScopeModel

setIsDynamicScope

public void setIsDynamicScope(boolean isDynamicScope)

Specified by:

setIsDynamicScope in interface ClientScopeModel

getDynamicScopeRegexp

public String getDynamicScopeRegexp()

Specified by:

getDynamicScopeRegexp in interface ClientScopeModel

getOid4vcProtocolMappersStream

public Stream<Oid4vcProtocolMapperModel> getOid4vcProtocolMappersStream()

getProtocolMappersStream

public Stream<ProtocolMapperModel> getProtocolMappersStream()

Description copied from interface: ProtocolMapperContainerModel

Returns protocol mappers as a stream.

Specified by:

getProtocolMappersStream in interface ProtocolMapperContainerModel

Returns:

Stream of protocol mapper. Never returns null.

addProtocolMapper

public ProtocolMapperModel addProtocolMapper(ProtocolMapperModel model)

Specified by:

addProtocolMapper in interface ProtocolMapperContainerModel

removeProtocolMapper

public void removeProtocolMapper(ProtocolMapperModel mapping)

Specified by:

removeProtocolMapper in interface ProtocolMapperContainerModel

updateProtocolMapper

public void updateProtocolMapper(ProtocolMapperModel mapping)

Specified by:

updateProtocolMapper in interface ProtocolMapperContainerModel

getProtocolMapperById

public ProtocolMapperModel getProtocolMapperById(String id)

Specified by:

getProtocolMapperById in interface ProtocolMapperContainerModel

getProtocolMapperByType

public List<ProtocolMapperModel> getProtocolMapperByType(String type)

Specified by:

getProtocolMapperByType in interface ProtocolMapperContainerModel

getProtocolMapperByName

public ProtocolMapperModel getProtocolMapperByName(String protocol,
 String name)

Specified by:

getProtocolMapperByName in interface ProtocolMapperContainerModel

getScopeMappingsStream

public Stream<RoleModel> getScopeMappingsStream()

Description copied from interface: ScopeContainerModel

Returns scope mappings for this scope container as a stream.

Specified by:

getScopeMappingsStream in interface ScopeContainerModel

Returns:

Stream of RoleModel. Never returns null.

getRealmScopeMappingsStream

public Stream<RoleModel> getRealmScopeMappingsStream()

Description copied from interface: ScopeContainerModel

From the scope mappings returned by ScopeContainerModel.getScopeMappingsStream() returns only those that belong to the realm that owns this scope container.

Specified by:

getRealmScopeMappingsStream in interface ScopeContainerModel

Returns:

stream of RoleModel. Never returns null.

addScopeMapping

public void addScopeMapping(RoleModel role)

Specified by:

addScopeMapping in interface ScopeContainerModel

deleteScopeMapping

public void deleteScopeMapping(RoleModel role)

Specified by:

deleteScopeMapping in interface ScopeContainerModel

hasDirectScope

public boolean hasDirectScope(RoleModel role)

Description copied from interface: ScopeContainerModel

Returns true, if this object has the given role directly in its scope.

Specified by:

hasDirectScope in interface ScopeContainerModel

Parameters:

role - the role

Returns:

see description

See Also:

• if you want to check whether this object has the given role directly or indirectly in its scope

hasScope

public boolean hasScope(RoleModel role)

Description copied from interface: ScopeContainerModel

Returns true, if this object has the given role directly or indirectly in its scope, false otherwise.

Specified by:

hasScope in interface ScopeContainerModel

Parameters:

role - the role

Returns:

see description

See Also:

• if you want to check if this object has the given role directly in its scope