Repository navigation
Keycloak as Wallet-Verifier (OpenID 4 Verifiable Presentations) #47346
dominikschlosser
started this conversation in
Ideas
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
- 6ED6
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hello!
As some of you may already know, i helped my customer develop an OpenID4VP-extension, which i presented at Keycloak DevDay. After talking to @stianst at this conference, i wanted to open this discussion to talk about if and how some or all of it might be added to Keycloak Core.
The extension can be found here: https://github.com/ba-itsys/keycloak-extension-oid4vp
It obviously is in an early state but is already used successfully in the so called "sandbox" testing environment from german SPRIND (which provides the german version of the EUDI wallet).
One use case for this, outside of wallet authentication in Keycloak itself, is to allow other IdP-implementations and OIDC-aware service providers to use the wallet with minimal changes. This is why we also open sourced a "wallet-connector", which is basically an example config using the OID4VP-extension: https://github.com/ba-itsys/eudi-wallet-connector
(One thing to note here: It relies on
transient-usersexperimental feature to not have to deal with user creation, which is not desirable when just acting as a "connector")The extension uses the SD-JWT support that Keycloak already provides (introduced with the VCI stuff) and also adds mDoc support (which is the second credential format every EUDI wallet verifier must understand).
It provides an
identity_providerSPI implementation and a pair ofidentity-provider-mapperimplementations that map the verified credential claims into the user session or user attributes. The mapper configuration is also used to generate theDCQLquery automatically, which otherwise would be quite cumbersome to keep in sync.It also runs successfully against the current set of OIDF conformance tests (which are still very limited though).
What are your thoughts?
All reactions
Replies: 4 comments · 3 replies
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hey @dominikschlosser Thank you very much for sharing this, it's excellent work and greatly appreciated.
Within the OAuth SIG, we have been focusing on OID4VCI over the past several years. While issuance has been our primary priority, a number of SIG members have also expressed strong interest in OID4VP. We’ve made significant progress in enhancing the security of OID4VCI, and we are aiming to bring this feature to a preview state by version 26.7.
In addition, it may be worthwhile to revisit OID4VP alongside OID4VCI. From my perspective, considering both specifications together could help us develop a more comprehensive understanding.
Would you be interested in joining one of our OAuth SIG weekly meetings? If that’s not convenient, I would be more than happy to arrange a separate meeting at a time that suits you.
https://www.keycloak.org/community
https://zoom-lfx.platform.linuxfoundation.org/meetings/keycloak
If possible, could you also share your presentation slides and or any sequence diagrams you may have for your various use cases? That would be extremely helpful for our discussions.
Thank you again, and I look forward to your thoughts.
Cc: @francis-pouatcha @mposolda @IngridPuppet @tdiesler @thomasdarimont @Captain-P-Goldfish @wistefan @babisRoutis
All reactions
Uh oh!
There was an error while loading. Please reload this page.
Hey @VinodAnandan i can participate next week (8.4.) and will prepare a few diagrams.
All reactions
Uh oh!
There was an error while loading. Please reload this page.
We would like to get this into Keycloak for sure, but right now we need to focus and prioritise the OID4VCI side of things. We should keep in touch and figure out what the best timing would be for a contribution.
cc @mposolda
All reactions
Uh oh!
There was an error while loading. Please reload this page.
@dominikschlosser do you want to create a GH issue for this?
All reactions
Uh oh!
There was an error while loading. Please reload this page.
@tdiesler and i are already working on a first working PR for this as part of the OAuth-SIG. Right now we are tracking the work outside of the Keycloak project. Maybe we should move these issues to Keycloak itself?
All reactions
Uh oh!
There was an error while loading. Please reload this page.
I would love to see this eventually in Keycloak core, but right now we simply don't have capacity for it. One reason is the focus on OIDC4VCI and moving that towards a preview state.
It would be better to continue the work in your extension, and we can come up with a plan for when we can get the extension contributed to core.
The alternative of starting to merge this as a experimental feature in Keycloak will just slow everything down. Keycloak maintainers won't have capacity to review PRs around it, which will slow down development, and at the same time impact other work like OIDC4VCI.
It would be great however to create a GH issue that can be linked to the extension, and where community can upvote to show their interest in getting this into core.
@dominikschlosser feel free to ping me on Slack or email and we can discuss further.
All reactions
Uh oh!
There was an error while loading. Please reload this page.
@stianst I created an issue: #49415
All reactions