Package org.keycloak.protocol.oid4vc.utils

Class OID4VCUtil

java.lang.Object

org.keycloak.protocol.oid4vc.utils.OID4VCUtil

public class OID4VCUtil
extends Object

Method Summary

Modifier and Type	Method	Description
static IssuedVerifiableCredentialModel	checkIssuedVerifiableCredential(KeycloakSession session, UserModel user, String issuedCredentialId, CredentialScopeModel expectedCredentialScope, ClientModel expectedClient)	Check issued-credential present on the user with expected ID and expected issued-credential-id and credential-scope
static List<IssuedVerifiableCredentialModel>	getIssuedVerifiableCredentialsByUserAndClient(KeycloakSession session, UserModel user, ClientModel client)
static String	getOfferAsUri(KeycloakSession session, String nonce)
static long	getPasswordCredentialTimestamp(UserModel user)	Returns the timestamp exposed by the user's password credential.
static boolean	hasVerifiableCredential(KeycloakSession session, UserModel user, CredentialScopeModel credentialScope)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

getOfferAsUri

public static String getOfferAsUri(KeycloakSession session,
 String nonce)

Parameters:

session - Keycloak session

nonce - nonce, which is part of the credential offer URI

Returns:

Credential offer as URI, which can be shared with the wallet

hasVerifiableCredential

public static boolean hasVerifiableCredential(KeycloakSession session,
 UserModel user,
 CredentialScopeModel credentialScope)

Parameters:

session - Keycloak session

user - user

credentialScope - credential scope

Returns:

true if particular user has verifiable credential set on his account

getPasswordCredentialTimestamp

public static long getPasswordCredentialTimestamp(UserModel user)

Returns the timestamp exposed by the user's password credential.

The combined credential stream is important for federated users because providers such as LDAP expose their password modification timestamp as federated credential metadata rather than as a locally stored credential.

Returns:

the credential timestamp, 0 when the credential has no timestamp, or -1 when no password credential metadata is available

checkIssuedVerifiableCredential

public static IssuedVerifiableCredentialModel checkIssuedVerifiableCredential(KeycloakSession session,
 UserModel user,
 String issuedCredentialId,
 CredentialScopeModel expectedCredentialScope,
 ClientModel expectedClient)

Check issued-credential present on the user with expected ID and expected issued-credential-id and credential-scope

Parameters:

session - kc session

user - user

issuedCredentialId - issued credential ID

expectedCredentialScope - expected credential scope

expectedClient - expected client

Returns:

issued verifiable credential model (as long as it is found)

Throws:

IllegalStateException - in case that issued-credential not present or does not match with user, client or clientScope

IllegalStateException - in case that issued verifiable credential is not found or is expired

getIssuedVerifiableCredentialsByUserAndClient

public static List<IssuedVerifiableCredentialModel> getIssuedVerifiableCredentialsByUserAndClient(KeycloakSession session,
 UserModel user,
 ClientModel client)