wistefan · Jan 5, 2024 · Jan 5, 2024 · Jan 1, 2024 · Jan 5, 2024 · Jan 4, 2024
@@ -104,6 +104,8 @@ public enum Feature {
         MULTI_SITE("Multi-site support", Type.PREVIEW),
 
         OFFLINE_SESSION_PRELOADING("Offline session preloading", Type.DEPRECATED),
+
+        OID4VC_VCI("Support for the OID4VCI protocol as part of OID4VC.", Type.PREVIEW)
         ;
 
         private final Type type;

@@ -30,6 +30,12 @@
     <name>Keycloak REST Services</name>
     <description />
 
+    <properties>
+        <maven.compiler.release>17</maven.compiler.release>
+        <maven.compiler.source>17</maven.compiler.source>
+        <maven.compiler.target>17</maven.compiler.target>
+    </properties>
+
     <dependencies>
         <dependency>
             <groupId>org.keycloak</groupId>

@@ -0,0 +1,17 @@
+package org.keycloak.protocol.oid4vc.issuance;
+
+/**
+ * Exception to be thrown in case credentials issuance fails.
+ *
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public class VCIssuerException extends RuntimeException {
+
+    public VCIssuerException(String message) {
+        super(message);
+    }
+
+    public VCIssuerException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}
@@ -0,0 +1,28 @@
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
+
+import java.time.Clock;
+
+/**
+ * {@link VerifiableCredentialsSigningService} implementing the JWT_VC format. It returns a string, containing the
+ * Signed JWT-Credential
+ * {@see https://identity.foundation/jwt-vc-presentation-profile/}
+ *
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public class JwtSigningService extends SigningService<String> {
+
+    public JwtSigningService(KeycloakSession keycloakSession, String keyId, Clock clock, String algorithmType) {
+        super(keycloakSession, keyId, clock, algorithmType);
+    }
+
+    @Override
+    public String signCredential(VerifiableCredential verifiableCredential) {
+
+        throw new UnsupportedOperationException("JWT-VC Credentials Signing is not yet supported.");
+    }
+
+}
@@ -0,0 +1,56 @@
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.component.ComponentModel;
+import org.keycloak.component.ComponentValidationException;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.protocol.oid4vc.model.Format;
+import org.keycloak.provider.ConfigurationValidationHelper;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.List;
+
+/**
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public class JwtSigningServiceProviderFactory implements VCSigningServiceProviderFactory {
+
+    public static final Format SUPPORTED_FORMAT = Format.JWT_VC;
+    private static final String HELP_TEXT = "Issues JWT-VCs following the specification of https://identity.foundation/jwt-vc-presentation-profile/.";
+
+    @Override
+    public VerifiableCredentialsSigningService create(KeycloakSession session, ComponentModel model) {
+        var keyId = model.get(SigningProperties.KEY_ID.getKey());
+        var algorithmType = model.get(SigningProperties.ALGORITHM_TYPE.getKey());
+
+        return new JwtSigningService(session, keyId, CLOCK, algorithmType);
+    }
+
+    @Override
+    public String getHelpText() {
+        return HELP_TEXT;
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return VCSigningServiceProviderFactory.configurationBuilder()
+                .property(SigningProperties.ALGORITHM_TYPE.asConfigProperty())
+                .build();
+    }
+
+    @Override
+    public String getId() {
+        return SUPPORTED_FORMAT.toString();
+    }
+
+    @Override
+    public void validateSpecificConfiguration(KeycloakSession session, RealmModel realm, ComponentModel model) throws ComponentValidationException {
+        ConfigurationValidationHelper.check(model)
+                .checkRequired(SigningProperties.ALGORITHM_TYPE.asConfigProperty());
+    }
+
+    @Override
+    public Format supportedFormat() {
+        return SUPPORTED_FORMAT;
+    }
+}
@@ -0,0 +1,31 @@
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
+
+import java.time.Clock;
+
+/**
+ * {@link VerifiableCredentialsSigningService} implementing the LDP_VC format. It returns a Verifiable Credential,
+ * containing the created LDProof.
+ * <p>
+ * {@see https://www.w3.org/TR/vc-data-model/}
+ *
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public class LDSigningService extends SigningService<VerifiableCredential> {
+
+
+    public LDSigningService(KeycloakSession keycloakSession, String keyId, Clock clock, String ldpType) {
+        super(keycloakSession, keyId, clock, ldpType);
+
+    }
+
+    @Override
+    public VerifiableCredential signCredential(VerifiableCredential verifiableCredential) {
+
+        throw new UnsupportedOperationException("LD-Credentials Signing is not yet supported.");
+    }
+
+}
@@ -0,0 +1,57 @@
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.Config;
+import org.keycloak.component.ComponentModel;
+import org.keycloak.component.ComponentValidationException;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.protocol.oid4vc.model.Format;
+import org.keycloak.provider.ConfigurationValidationHelper;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.List;
+
+/**
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public class LDSigningServiceProviderFactory implements VCSigningServiceProviderFactory {
+    public static final Format SUPPORTED_FORMAT = Format.LDP_VC;
+    private static final String HELP_TEXT = "Issues Verifiable Credentials in the W3C Data Model, using Linked-Data Proofs. See https://www.w3.org/TR/vc-data-model/";
+
+    @Override
+    public VerifiableCredentialsSigningService create(KeycloakSession session, ComponentModel model) {
+        var keyId = model.get(SigningProperties.KEY_ID.getKey());
+        var proofType = model.get(SigningProperties.PROOF_TYPE.getKey());
+        return new LDSigningService(session, keyId, CLOCK, proofType);
+    }
+
+    @Override
+    public String getHelpText() {
+        return HELP_TEXT;
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return VCSigningServiceProviderFactory.configurationBuilder()
+                .property(SigningProperties.PROOF_TYPE.asConfigProperty())
+                .build();
+    }
+
+    @Override
+    public String getId() {
+        return SUPPORTED_FORMAT.toString();
+    }
+
+    @Override
+    public void validateSpecificConfiguration(KeycloakSession session, RealmModel realm, ComponentModel model) throws ComponentValidationException {
+        ConfigurationValidationHelper.check(model)
+                .checkRequired(SigningProperties.PROOF_TYPE.asConfigProperty());
+    }
+
+    @Override
+    public Format supportedFormat() {
+        return SUPPORTED_FORMAT;
+    }
+
+}
+
@@ -0,0 +1,27 @@
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
+
+import java.time.Clock;
+
+/**
+ * {@link VerifiableCredentialsSigningService} implementing the SD_JWT_VC format. It returns a String, containing
+ * the signed SD-JWT
+ * <p>
+ * {@see https://drafts.oauth.net/oauth-sd-jwt-vc/draft-ietf-oauth-sd-jwt-vc.html}
+ * {@see https://www.ietf.org/archive/id/draft-fett-oauth-selective-disclosure-jwt-02.html}
+ *
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public class SdJwtSigningService extends SigningService<String> {
+
+    public SdJwtSigningService(KeycloakSession keycloakSession, String keyId, Clock clock, String algorithmType) {
+        super(keycloakSession, keyId, clock, algorithmType);
+    }
+
+    @Override
+    public String signCredential(VerifiableCredential verifiableCredential) {
+        throw new UnsupportedOperationException("SD-JWT Signing is not yet supported.");
+    }
+}
@@ -0,0 +1,57 @@
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.component.ComponentModel;
+import org.keycloak.component.ComponentValidationException;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.protocol.oid4vc.model.Format;
+import org.keycloak.provider.ConfigurationValidationHelper;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.List;
+
+/**
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public class SdJwtSigningServiceProviderFactory implements VCSigningServiceProviderFactory {
+
+    public static final Format SUPPORTED_FORMAT = Format.SD_JWT_VC;
+    private static final String HELP_TEXT = "Issues SD-JWT-VCs following the specification of https://drafts.oauth.net/oauth-sd-jwt-vc/draft-ietf-oauth-sd-jwt-vc.html.";
+
+    @Override
+    public VerifiableCredentialsSigningService create(KeycloakSession session, ComponentModel model) {
+        var keyId = model.get(SigningProperties.KEY_ID.getKey());
+        var algorithmType = model.get(SigningProperties.ALGORITHM_TYPE.getKey());
+        return new SdJwtSigningService(session, keyId, CLOCK, algorithmType);
+    }
+
+    @Override
+    public String getHelpText() {
+        return HELP_TEXT;
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return VCSigningServiceProviderFactory.configurationBuilder()
+                .property(SigningProperties.ALGORITHM_TYPE.asConfigProperty())
+                .property(SigningProperties.DECOYS.asConfigProperty())
+                .build();
+    }
+
+    @Override
+    public String getId() {
+        return SUPPORTED_FORMAT.toString();
+    }
+
+    @Override
+    public void validateSpecificConfiguration(KeycloakSession session, RealmModel realm, ComponentModel model) throws ComponentValidationException {
+        ConfigurationValidationHelper.check(model)
+                .checkRequired(SigningProperties.ALGORITHM_TYPE.asConfigProperty())
+                .checkInt(SigningProperties.DECOYS.asConfigProperty(), true);
+    }
+
+    @Override
+    public Format supportedFormat() {
+        return SUPPORTED_FORMAT;
+    }
+}
@@ -0,0 +1,41 @@
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.crypto.Algorithm;
+import org.keycloak.provider.ProviderConfigProperty;
+
+/**
+ * Properties for configuring the {@link VerifiableCredentialsSigningService}'s
+ *
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public enum SigningProperties {
+
+    ISSUER_DID("issuerDid", "Did of the issuer.", "Provide the DID of the issuer. Needs to match the provided key material.", ProviderConfigProperty.STRING_TYPE, null),
+    KEY_ID("keyId", "Id of the signing key.", "The id of the key to be used for signing credentials. The key needs to be provided as a realm key.", ProviderConfigProperty.STRING_TYPE, null),
+    PROOF_TYPE("proofType", "Type of the LD-Proof.", "The type of LD-Proofs to be created. Needs to fit the provided signing key.", ProviderConfigProperty.STRING_TYPE, null),
+    ALGORITHM_TYPE("algorithmType", "Type of the signing algorithm.", "The type of the algorithm to be used for signing. Needs to fit the provided signing key.", ProviderConfigProperty.STRING_TYPE, Algorithm.RS256),
+    DECOYS("decoys", "Number of decoys to be added.", "The number of decoys to be added to the SD-JWT.", ProviderConfigProperty.STRING_TYPE, 0);
+
+    private final String key;
+    private final String label;
+    private final String helpText;
+    private final String type;
+    private final Object defaultValue;
+
+    SigningProperties(String key, String label, String helpText, String type, Object defaultValue) {
+        this.key = key;
+        this.label = label;
+        this.helpText = helpText;
+        this.type = type;
+        this.defaultValue = defaultValue;
+    }
+
+
+    public ProviderConfigProperty asConfigProperty() {
+        return new ProviderConfigProperty(key, label, helpText, type, defaultValue);
+    }
+
+    public String getKey() {
+        return key;
+    }
+}