Package org.keycloak.protocol.oid4vc.issuance.keybinding

Class JwtCNonceHandler

java.lang.Object

org.keycloak.protocol.oid4vc.issuance.keybinding.JwtCNonceHandler

All Implemented Interfaces:

CNonceHandler, Provider

public class JwtCNonceHandler
extends Object
implements CNonceHandler

Author:

Pascal Knüppel

Field Summary

Fields

Modifier and Type	Field	Description
static final int	NONCE_DEFAULT_LENGTH
static final int	NONCE_LENGTH_RANDOM_OFFSET
static final String	SOURCE_ENDPOINT

Constructor Summary

Constructors

Constructor	Description
JwtCNonceHandler(KeycloakSession keycloakSession)

Method Summary

Modifier and Type	Method	Description
String	buildCNonce(List<String> audiences, Map<String,Object> additionalDetails)	used to build a cNonce in any style.
protected boolean	checkAttributeEquality(String key, Object object, Object actualValue)
void	consumeCNonce(String cNonce)	Marks a verified cNonce value as consumed.
void	consumeCNonce(String cNonce, JsonWebToken cNonceToken)	Marks a verified cNonce value as consumed.
void	ensureCNonceNotYetConsumed(String cNonce)	Checks if cNonce is so far not yet consumed (without consuming it) for fail-fast purposes.
protected KeyWrapper	selectSigningKey(RealmModel realm)
boolean	supportsCNonceConsumption()
boolean	supportsCNonceTokenRetrieval()
void	verifyCNonce(String cNonce, List<String> audiences, Map<String,Object> additionalDetails)	must verify the validity of a cNonce value that has been issued by the CNonceHandler.buildCNonce(List, Map) method.
JsonWebToken	verifyCNonceAndGetToken(String cNonce, List<String> audiences, Map<String,Object> additionalDetails)	Verifies the validity of a cNonce value and returns its verified token representation.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.protocol.oid4vc.issuance.keybinding.CNonceHandler

close

Field Details

SOURCE_ENDPOINT

public static final String SOURCE_ENDPOINT

See Also:

• Constant Field Values

NONCE_DEFAULT_LENGTH

public static final int NONCE_DEFAULT_LENGTH

See Also:

• Constant Field Values

NONCE_LENGTH_RANDOM_OFFSET

public static final int NONCE_LENGTH_RANDOM_OFFSET

See Also:

• Constant Field Values

Constructor Details

JwtCNonceHandler

public JwtCNonceHandler(KeycloakSession keycloakSession)

Method Details

buildCNonce

public String buildCNonce(List<String> audiences,
 Map<String,Object> additionalDetails)

Description copied from interface: CNonceHandler

used to build a cNonce in any style. For jwt-based cNonces we will additionally require the audience-values that should be added into the cNonce

Specified by:

buildCNonce in interface CNonceHandler

Parameters:

audiences - the audiences for jwt-based cNonces

additionalDetails - additional attributes that might be required to build the cNonce and that are handler specific

Returns:

the cNonce in string representation

verifyCNonce

public void verifyCNonce(String cNonce,
 List<String> audiences,
 @Nullable
 Map<String,Object> additionalDetails)
                  throws VerificationException

Description copied from interface: CNonceHandler

must verify the validity of a cNonce value that has been issued by the CNonceHandler.buildCNonce(List, Map) method.

Specified by:

verifyCNonce in interface CNonceHandler

Parameters:

cNonce - the cNonce to validate

audiences - the expected audiences for jwt-based cNonces

additionalDetails - additional attributes that might be required to build the cNonce and that are handler specific

Throws:

VerificationException - if the cNonce cannot be verified

verifyCNonceAndGetToken

public JsonWebToken verifyCNonceAndGetToken(String cNonce,
 List<String> audiences,
 @Nullable
 Map<String,Object> additionalDetails)
                                     throws VerificationException

Description copied from interface: CNonceHandler

Verifies the validity of a cNonce value and returns its verified token representation.

Specified by:

verifyCNonceAndGetToken in interface CNonceHandler

Parameters:

cNonce - the cNonce to validate

audiences - the expected audiences for jwt-based cNonces

additionalDetails - additional attributes that might be required to build the cNonce and that are handler specific

Returns:

the verified cNonce token representation

Throws:

VerificationException - if the cNonce cannot be verified

supportsCNonceTokenRetrieval

public boolean supportsCNonceTokenRetrieval()

Specified by:

supportsCNonceTokenRetrieval in interface CNonceHandler

Returns:

true if this handler can return the verified cNonce token representation.

ensureCNonceNotYetConsumed

public void ensureCNonceNotYetConsumed(String cNonce)
                                throws VerificationException

Description copied from interface: CNonceHandler

Checks if cNonce is so far not yet consumed (without consuming it) for fail-fast purposes.

Specified by:

ensureCNonceNotYetConsumed in interface CNonceHandler

Throws:

VerificationException - if already consumed or check not supported.

consumeCNonce

public void consumeCNonce(String cNonce)
                   throws VerificationException

Description copied from interface: CNonceHandler

Marks a verified cNonce value as consumed.

Specified by:

consumeCNonce in interface CNonceHandler

Parameters:

cNonce - the cNonce to consume

Throws:

VerificationException

consumeCNonce

public void consumeCNonce(String cNonce,
 JsonWebToken cNonceToken)
                   throws VerificationException

Description copied from interface: CNonceHandler

Marks a verified cNonce value as consumed.

Specified by:

consumeCNonce in interface CNonceHandler

Parameters:

cNonce - the cNonce to consume

cNonceToken - the already verified cNonce token

Throws:

VerificationException

supportsCNonceConsumption

public boolean supportsCNonceConsumption()

Specified by:

supportsCNonceConsumption in interface CNonceHandler

Returns:

true if this handler can mark cNonce values as consumed.

checkAttributeEquality

protected boolean checkAttributeEquality(String key,
 Object object,
 Object actualValue)
                                  throws VerificationException

Throws:

VerificationException

selectSigningKey

protected KeyWrapper selectSigningKey(RealmModel realm)