Package org.keycloak.protocol.oid4vc.issuance.keybinding

Interface AttestationKeyResolver

All Known Implementing Classes:

StaticAttestationKeyResolver, TrustedAttestationKeyResolver

public interface AttestationKeyResolver

Interface for resolving attestation public keys by kid for JWT attestation validation. Implementations may use local registries, remote JWKS, or other trusted sources.

Author:

Rodrick Awambeng

Method Summary

Modifier and Type	Method	Description
JWK	resolveKey(String kid, Map<String,Object> header, Map<String,Object> payload)	Resolves a JWK for the given kid, header, and payload context.
JWK	resolveX5c(List<String> x5c, Map<String,Object> header, Map<String,Object> payload)	Resolves and validates an attestation certificate chain.

Method Details

resolveKey

JWK resolveKey(String kid,
 Map<String,Object> header,
 Map<String,Object> payload)

Resolves a JWK for the given kid, header, and payload context. Returns null if the key cannot be resolved or is not trusted.

resolveX5c

JWK resolveX5c(List<String> x5c,
 Map<String,Object> header,
 Map<String,Object> payload)

Resolves and validates an attestation certificate chain. Returning null means that none of the configured trust sources trusts the chain.