Package org.keycloak.models.oid4vci

Class CredentialScopeModel

java.lang.Object
org.keycloak.models.oid4vci.CredentialScopeModel
All Implemented Interfaces:
org.keycloak.models.ClientScopeModel, org.keycloak.models.OrderedModel, org.keycloak.models.ProtocolMapperContainerModel, org.keycloak.models.ScopeContainerModel
public class CredentialScopeModel extends Object implements org.keycloak.models.ClientScopeModel
This class acts as delegate for a ClientScopeModel implementation and adds additional functionality for OpenId4VC credentials
Author:
Pascal Knüppel

  • Field Details

    • CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT

      public static final String CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT
      See Also:

    • VC_BUILD_CONFIG_HASH_ALGORITHM_DEFAULT

      public static final String VC_BUILD_CONFIG_HASH_ALGORITHM_DEFAULT
      See Also:

    • VC_BUILD_CONFIG_SD_JWT_VISIBLE_CLAIMS_DEFAULT

      public static final String VC_BUILD_CONFIG_SD_JWT_VISIBLE_CLAIMS_DEFAULT
      See Also:

    • VC_BUILD_CONFIG_TOKEN_JWS_TYPE_DEFAULT_SD_JWT_VC

      public static final String VC_BUILD_CONFIG_TOKEN_JWS_TYPE_DEFAULT_SD_JWT_VC
      See Also:

    • VC_BUILD_CONFIG_TOKEN_JWS_TYPE_DEFAULT_JWT_VC

      public static final String VC_BUILD_CONFIG_TOKEN_JWS_TYPE_DEFAULT_JWT_VC
      See Also:

    • VC_EXPIRY_IN_SECONDS_DEFAULT

      public static final Integer VC_EXPIRY_IN_SECONDS_DEFAULT

    • VC_FORMAT_DEFAULT

      public static final String VC_FORMAT_DEFAULT
      See Also:

    • VC_SD_JWT_NUMBER_OF_DECOYS_DEFAULT

      public static final Integer VC_SD_JWT_NUMBER_OF_DECOYS_DEFAULT

    • VC_CONFIGURATION_ID

      public static final String VC_CONFIGURATION_ID
      the credential configuration id as provided in the metadata endpoint
      See Also:

    • VC_IDENTIFIER

      public static final String VC_IDENTIFIER
      See Also:

    • VC_FORMAT

      public static final String VC_FORMAT
      See Also:

    • VC_EXPIRY_IN_SECONDS

      public static final String VC_EXPIRY_IN_SECONDS
      See Also:

    • VC_ISSUER_DID

      public static final String VC_ISSUER_DID
      See Also:

    • VCT

      public static final String VCT
      See Also:

    • VC_SUPPORTED_TYPES

      public static final String VC_SUPPORTED_TYPES
      the value that is added into the "types"-attribute of a verifiable credential
      See Also:

    • VC_CONTEXTS

      public static final String VC_CONTEXTS
      the value that is entered into the "@contexts"-attribute of a verifiable credential
      See Also:

    • VC_SIGNING_ALG

      public static final String VC_SIGNING_ALG
      The credential signature algorithm. If it is not configured, then the realm active key is used to sign the verifiable credential
      See Also:

    • VC_CRYPTOGRAPHIC_BINDING_METHODS

      public static final String VC_CRYPTOGRAPHIC_BINDING_METHODS
      if the credential is only meant for specific cryptographic binding algorithms the global default list can be overridden here. The global default list is retrieved from the available keys in the realm.
      See Also:

    • VC_SIGNING_KEY_ID

      public static final String VC_SIGNING_KEY_ID
      an optional configuration that can be used to select a specific key for signing the credential
      See Also:

    • VC_DISPLAY

      public static final String VC_DISPLAY
      an optional attribute for the metadata endpoint
      See Also:

    • VC_SD_JWT_NUMBER_OF_DECOYS

      public static final String VC_SD_JWT_NUMBER_OF_DECOYS
      this attribute holds a customizable value for the number of decoys to use in a SD-JWT credential
      See Also:

    • VC_BUILD_CONFIG_SD_JWT_VISIBLE_CLAIMS

      public static final String VC_BUILD_CONFIG_SD_JWT_VISIBLE_CLAIMS
      an optional attribute that tells us which attributes should be added into the SD-JWT body.
      See Also:

    • VC_BUILD_CONFIG_HASH_ALGORITHM

      public static final String VC_BUILD_CONFIG_HASH_ALGORITHM
      an optional configuration that can be used to select a specific hash algorithm
      See Also:

    • VC_BUILD_CONFIG_TOKEN_JWS_TYPE

      public static final String VC_BUILD_CONFIG_TOKEN_JWS_TYPE
      this attribute holds the 'typ' value that will be added into the JWS header of the credential.
      See Also:

    • VC_INCLUDE_IN_METADATA

      public static final String VC_INCLUDE_IN_METADATA
      this configuration property can be used to enforce specific claims to be included in the metadata, if they would normally not and vice versa
      See Also:

    • VC_KEY_ATTESTATION_REQUIRED

      public static final String VC_KEY_ATTESTATION_REQUIRED
      OPTIONAL. Object that describes the requirement for key attestations as described in Appendix D, which the Credential Issuer expects the Wallet to send within the proof(s) of the Credential Request. If the Credential Issuer does not require a key attestation, this parameter MUST NOT be present in the metadata. If both key_storage and user_authentication parameters are absent, the key_attestations_required parameter may be empty, indicating a key attestation is needed without additional constraints.
      See Also:

    • VC_KEY_ATTESTATION_REQUIRED_KEY_STORAGE

      public static final String VC_KEY_ATTESTATION_REQUIRED_KEY_STORAGE
      OPTIONAL. A non-empty array defining values specified in Appendix D.2 accepted by the Credential Issuer.
      See Also:

    • VC_KEY_ATTESTATION_REQUIRED_USER_AUTH

      public static final String VC_KEY_ATTESTATION_REQUIRED_USER_AUTH
      OPTIONAL. A non-empty array defining values specified in Appendix D.2 accepted by the Credential Issuer.
      See Also:

    • VC_BINDING_REQUIRED

      public static final String VC_BINDING_REQUIRED
      OPTIONAL. Flag that indicates whether cryptographic holder binding is REQUIRED for this credential configuration. If this flag is not set or set to false, the issuer metadata MUST omit the cryptographic_binding_methods_supported and proof_types_supported parameters for this configuration, meaning the wallet is not required to provide cryptographic key material or proofs.

      If true, the issuer metadata MUST include those parameters and the issuer MUST enforce the corresponding proof types during credential issuance, as per OID4VCI Section 12.2.4.

      See Also:

    • VC_BINDING_REQUIRED_PROOF_TYPES

      public static final String VC_BINDING_REQUIRED_PROOF_TYPES
      OPTIONAL. Comma-separated list of proof types that are REQUIRED for this credential configuration when VC_BINDING_REQUIRED is set to true. Example: "jwt,attestation".

      If VC_BINDING_REQUIRED is false or this attribute is empty/absent, no proof types are required and metadata MUST omit cryptographic_binding_methods_supported and proof_types_supported.

      See Also:

    • VC_REFRESH_INTERVAL_IN_SECONDS

      public static final String VC_REFRESH_INTERVAL_IN_SECONDS
      The interval in seconds at which the wallet should refresh the credential. This determines the expiration date (`exp` claim) in the actual VC returned to the wallet. If not set, defaults to the smaller of VC_REFRESH_INTERVAL_IN_SECONDS_DEFAULT (7 days) or the credential lifetime.
      See Also:

    • VC_REFRESH_INTERVAL_IN_SECONDS_DEFAULT

      public static final Integer VC_REFRESH_INTERVAL_IN_SECONDS_DEFAULT

  • Constructor Details

    • CredentialScopeModel

      public CredentialScopeModel(org.keycloak.models.ClientScopeModel clientScope)

  • Method Details

    • getIssuerDid

      public String getIssuerDid()

    • setIssuerDid

      public void setIssuerDid(String issuerDid)

    • getScope

      public String getScope()

    • getCredentialConfigurationId

      public String getCredentialConfigurationId()

    • setCredentialConfigurationId

      public void setCredentialConfigurationId(String credentialConfigurationId)

    • getCredentialIdentifier

      public String getCredentialIdentifier()

    • setCredentialIdentifier

      public void setCredentialIdentifier(String credentialIdentifier)

    • getFormat

      public String getFormat()

    • setFormat

      public void setFormat(String credentialFormat)

    • getExpiryInSeconds

      public Integer getExpiryInSeconds()

    • setExpiryInSeconds

      public void setExpiryInSeconds(Integer expiryInSeconds)

    • getRefreshIntervalInSeconds

      public Integer getRefreshIntervalInSeconds()

    • setRefreshIntervalInSeconds

      public void setRefreshIntervalInSeconds(Integer refreshIntervalInSeconds)

    • getSdJwtNumberOfDecoys

      public Integer getSdJwtNumberOfDecoys()

    • setSdJwtNumberOfDecoys

      public void setSdJwtNumberOfDecoys(Integer sdJwtNumberOfDecoys)

    • getVct

      public String getVct()

    • setVct

      public void setVct(String vct)

    • getBuildConfigTokenJwsType

      public String getBuildConfigTokenJwsType()

    • setBuildConfigTokenJwsType

      public void setBuildConfigTokenJwsType(String tokenJwsType)

    • getDefaultTokenJwsTypeForFormat

      public static String getDefaultTokenJwsTypeForFormat(String format)

    • getSigningKeyId

      public String getSigningKeyId()

    • setSigningKeyId

      public void setSigningKeyId(String signingKeyId)

    • getBuildConfigHashAlgorithm

      public String getBuildConfigHashAlgorithm()

    • setBuildConfigHashAlgorithm

      public void setBuildConfigHashAlgorithm(String hashAlgorithm)

    • getSupportedCredentialTypes

      public List<String> getSupportedCredentialTypes()

    • setSupportedCredentialTypes

      public void setSupportedCredentialTypes(String supportedCredentialTypes)

    • setSupportedCredentialTypes

      public void setSupportedCredentialTypes(List<String> supportedCredentialTypes)

    • getVcContexts

      public List<String> getVcContexts()

    • setVcContexts

      public void setVcContexts(String vcContexts)

    • setVcContexts

      public void setVcContexts(List<String> vcContexts)

    • getSigningAlg

      public String getSigningAlg()

    • setSigningAlg

      public void setSigningAlg(String signingAlg)

    • getCryptographicBindingMethods

      public List<String> getCryptographicBindingMethods()

    • setCryptographicBindingMethods

      public void setCryptographicBindingMethods(String cryptographicBindingMethods)

    • setCryptographicBindingMethods

      public void setCryptographicBindingMethods(List<String> cryptographicBindingMethods)

    • getBuildConfigSdJwtVisibleClaims

      public List<String> getBuildConfigSdJwtVisibleClaims()

    • setBuildConfigSdJwtVisibleClaims

      public void setBuildConfigSdJwtVisibleClaims(String sdJwtVisibleClaims)

    • setBuildConfigSdJwtVisibleClaims

      public void setBuildConfigSdJwtVisibleClaims(List<String> sdJwtVisibleClaims)

    • getVcDisplay

      public String getVcDisplay()

    • setVcDisplay

      public void setVcDisplay(String vcDisplay)

    • isBindingRequired

      public boolean isBindingRequired()
      Whether cryptographic holder binding is required for this credential configuration.

    • setBindingRequired

      public void setBindingRequired(boolean required)

    • getRequiredProofTypes

      public List<String> getRequiredProofTypes()
      The list of proof types that are required for this credential configuration when binding is required. Returns an empty list if none are configured.

    • setRequiredProofTypes

      public void setRequiredProofTypes(List<String> proofTypes)

    • isKeyAttestationRequired

      public boolean isKeyAttestationRequired()

    • setKeyAttestationRequired

      public void setKeyAttestationRequired(boolean keyAttestationRequired)

    • getRequiredKeyAttestationKeyStorage

      public List<String> getRequiredKeyAttestationKeyStorage()

    • setRequiredKeyAttestationKeyStorage

      public void setRequiredKeyAttestationKeyStorage(List<String> keyStorage)

    • getRequiredKeyAttestationUserAuthentication

      public List<String> getRequiredKeyAttestationUserAuthentication()

    • setRequiredKeyAttestationUserAuthentication

      public void setRequiredKeyAttestationUserAuthentication(List<String> userAuthentication)

    • getId

      public String getId()
      Specified by:
      getId in interface org.keycloak.models.ClientScopeModel

    • getName

      public String getName()
      Specified by:
      getName in interface org.keycloak.models.ClientScopeModel

    • setName

      public void setName(String name)
      Specified by:
      setName in interface org.keycloak.models.ClientScopeModel

    • getRealm

      public org.keycloak.models.RealmModel getRealm()
      Specified by:
      getRealm in interface org.keycloak.models.ClientScopeModel

    • getDescription

      public String getDescription()
      Specified by:
      getDescription in interface org.keycloak.models.ClientScopeModel

    • setDescription

      public void setDescription(String description)
      Specified by:
      setDescription in interface org.keycloak.models.ClientScopeModel

    • getProtocol

      public String getProtocol()
      Specified by:
      getProtocol in interface org.keycloak.models.ClientScopeModel

    • setProtocol

      public void setProtocol(String protocol)
      Specified by:
      setProtocol in interface org.keycloak.models.ClientScopeModel

    • setAttribute

      public void setAttribute(String name, String value)
      Specified by:
      setAttribute in interface org.keycloak.models.ClientScopeModel

    • removeAttribute

      public void removeAttribute(String name)
      Specified by:
      removeAttribute in interface org.keycloak.models.ClientScopeModel

    • getAttribute

      public String getAttribute(String name)
      Specified by:
      getAttribute in interface org.keycloak.models.ClientScopeModel

    • getAttributes

      public Map<String,String> getAttributes()
      Specified by:
      getAttributes in interface org.keycloak.models.ClientScopeModel

    • isDisplayOnConsentScreen

      public boolean isDisplayOnConsentScreen()
      Specified by:
      isDisplayOnConsentScreen in interface org.keycloak.models.ClientScopeModel

    • setDisplayOnConsentScreen

      public void setDisplayOnConsentScreen(boolean displayOnConsentScreen)
      Specified by:
      setDisplayOnConsentScreen in interface org.keycloak.models.ClientScopeModel

    • getConsentScreenText

      public String getConsentScreenText()
      Specified by:
      getConsentScreenText in interface org.keycloak.models.ClientScopeModel

    • setConsentScreenText

      public void setConsentScreenText(String consentScreenText)
      Specified by:
      setConsentScreenText in interface org.keycloak.models.ClientScopeModel

    • getGuiOrder

      public String getGuiOrder()
      Specified by:
      getGuiOrder in interface org.keycloak.models.ClientScopeModel
      Specified by:
      getGuiOrder in interface org.keycloak.models.OrderedModel

    • setGuiOrder

      public void setGuiOrder(String guiOrder)
      Specified by:
      setGuiOrder in interface org.keycloak.models.ClientScopeModel

    • isIncludeInTokenScope

      public boolean isIncludeInTokenScope()
      Specified by:
      isIncludeInTokenScope in interface org.keycloak.models.ClientScopeModel

    • setIncludeInTokenScope

      public void setIncludeInTokenScope(boolean includeInTokenScope)
      Specified by:
      setIncludeInTokenScope in interface org.keycloak.models.ClientScopeModel

    • isParameterizedScope

      public boolean isParameterizedScope()
      Specified by:
      isParameterizedScope in interface org.keycloak.models.ClientScopeModel

    • setIsParameterizedScope

      public void setIsParameterizedScope(boolean isParameterizedScope)
      Specified by:
      setIsParameterizedScope in interface org.keycloak.models.ClientScopeModel

    • getParameterizedScopeRegexp

      public String getParameterizedScopeRegexp()
      Specified by:
      getParameterizedScopeRegexp in interface org.keycloak.models.ClientScopeModel

    • getOid4vcProtocolMappersStream

      public Stream<Oid4vcProtocolMapperModel> getOid4vcProtocolMappersStream()

    • getProtocolMappersStream

      public Stream<org.keycloak.models.ProtocolMapperModel> getProtocolMappersStream()
      Specified by:
      getProtocolMappersStream in interface org.keycloak.models.ProtocolMapperContainerModel

    • addProtocolMapper

      public org.keycloak.models.ProtocolMapperModel addProtocolMapper(org.keycloak.models.ProtocolMapperModel model)
      Specified by:
      addProtocolMapper in interface org.keycloak.models.ProtocolMapperContainerModel

    • removeProtocolMapper

      public void removeProtocolMapper(org.keycloak.models.ProtocolMapperModel mapping)
      Specified by:
      removeProtocolMapper in interface org.keycloak.models.ProtocolMapperContainerModel

    • updateProtocolMapper

      public void updateProtocolMapper(org.keycloak.models.ProtocolMapperModel mapping)
      Specified by:
      updateProtocolMapper in interface org.keycloak.models.ProtocolMapperContainerModel

    • getProtocolMapperById

      public org.keycloak.models.ProtocolMapperModel getProtocolMapperById(String id)
      Specified by:
      getProtocolMapperById in interface org.keycloak.models.ProtocolMapperContainerModel

    • getProtocolMapperByType

      public List<org.keycloak.models.ProtocolMapperModel> getProtocolMapperByType(String type)
      Specified by:
      getProtocolMapperByType in interface org.keycloak.models.ProtocolMapperContainerModel

    • getProtocolMapperByName

      public org.keycloak.models.ProtocolMapperModel getProtocolMapperByName(String protocol, String name)
      Specified by:
      getProtocolMapperByName in interface org.keycloak.models.ProtocolMapperContainerModel

    • getScopeMappingsStream

      public Stream<org.keycloak.models.RoleModel> getScopeMappingsStream()
      Specified by:
      getScopeMappingsStream in interface org.keycloak.models.ScopeContainerModel

    • getRealmScopeMappingsStream

      public Stream<org.keycloak.models.RoleModel> getRealmScopeMappingsStream()
      Specified by:
      getRealmScopeMappingsStream in interface org.keycloak.models.ScopeContainerModel

    • addScopeMapping

      public void addScopeMapping(org.keycloak.models.RoleModel role)
      Specified by:
      addScopeMapping in interface org.keycloak.models.ScopeContainerModel

    • deleteScopeMapping

      public void deleteScopeMapping(org.keycloak.models.RoleModel role)
      Specified by:
      deleteScopeMapping in interface org.keycloak.models.ScopeContainerModel

    • hasDirectScope

      public boolean hasDirectScope(org.keycloak.models.RoleModel role)
      Specified by:
      hasDirectScope in interface org.keycloak.models.ScopeContainerModel

    • hasScope

      public boolean hasScope(org.keycloak.models.RoleModel role)
      Specified by:
      hasScope in interface org.keycloak.models.ScopeContainerModel