Hello!

As some of you may already know, i helped my customer develop an OpenID4VP-extension, which i presented at Keycloak DevDay. After talking to @stianst at this conference, i wanted to open this discussion to talk about if and how some or all of it might be added to Keycloak Core.

The extension can be found here: https://github.com/ba-itsys/keycloak-extension-oid4vp
It obviously is in an early state but is already used successfully in the so called "sandbox" testing environment from german SPRIND (which provides the german version of the EUDI wallet).

One use case for this, outside of wallet authentication in Keycloak itself, is to allow other IdP-implementations and OIDC-aware service providers to use the wallet with minimal changes. This is why we also open sourced a "wallet-connector", which is basically an example config using the OID4VP-extension: https://github.com/ba-itsys/eudi-wallet-connector
(One thing to note here: It relies on transient-users experimental feature to not have to deal with user creation, which is not desirable when just acting as a "connector")

The extension uses the SD-JWT support that Keycloak already provides (introduced with the VCI stuff) and also adds mDoc support (which is the second credential format every EUDI wallet verifier must understand).
It provides an identity_provider SPI implementation and a pair of identity-provider-mapper implementations that map the verified credential claims into the user session or user attributes. The mapper configuration is also used to generate the DCQL query automatically, which otherwise would be quite cumbersome to keep in sync.

It also runs successfully against the current set of OIDF conformance tests (which are still very limited though).

What are your thoughts?