{"id":19901911,"url":"https://github.com/hyperledger-identus/keycloak-plugins","last_synced_at":"2026-03-01T07:34:26.902Z","repository":{"id":243889884,"uuid":"813674801","full_name":"hyperledger-identus/keycloak-plugins","owner":"hyperledger-identus","description":"Keycloak plugins for Identus Cloud Agent integration","archived":false,"fork":false,"pushed_at":"2024-07-18T09:48:58.000Z","size":79,"stargazers_count":4,"open_issues_count":1,"forks_count":0,"subscribers_count":14,"default_branch":"main","last_synced_at":"2025-05-02T23:36:04.023Z","etag":null,"topics":["identus","keycloak","oid4vci","oid4vp","ssi"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hyperledger-identus.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-11T14:23:41.000Z","updated_at":"2025-02-11T08:53:14.000Z","dependencies_parsed_at":"2024-06-24T11:04:35.005Z","dependency_job_id":"b759810a-74b9-42ff-ac78-d2913bef95ec","html_url":"https://github.com/hyperledger-identus/keycloak-plugins","commit_stats":null,"previous_names":["hyperledger/identus-keycloak-plugins","hyperledger-identus/keycloak-plugins"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/hyperledger-identus/keycloak-plugins","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hyperledger-identus%2Fkeycloak-plugins","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hyperledger-identus%2Fkeycloak-plugins/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hyperledger-identus%2Fkeycloak-plugins/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hyperledger-identus%2Fkeycloak-plugins/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hyperledger-identus","download_url":"https://codeload.github.com/hyperledger-identus/keycloak-plugins/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hyperledger-identus%2Fkeycloak-plugins/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29964178,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-01T06:55:38.174Z","status":"ssl_error","status_checked_at":"2026-03-01T06:53:04.810Z","response_time":124,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["identus","keycloak","oid4vci","oid4vp","ssi"],"created_at":"2024-11-12T20:16:35.142Z","updated_at":"2026-03-01T07:34:26.885Z","avatar_url":"https://github.com/hyperledger-identus.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Identus Keycloak Plugins\n\n![unit-tests](https://github.com/hyperledger/identus-keycloak-plugins/actions/workflows/unit-tests.yml/badge.svg)\n![GitHub Release](https://img.shields.io/github/v/release/hyperledger/identus-keycloak-plugins)\n\n# Overview\n\nThis repository provides a Keycloak Plugin that extends Keycloak's functionality to handle Self-Sovereign Identity (SSI)\ntasks,\nincluding OpenID for verifiable credential issuance.\n\n# Getting started\n\n## Using published docker image\n\n### Default Keycloak plugin image\n\nThe plugin is available as a pre-bundled Docker image.\nThis image includes Keycloak and the plugin enabled for basic use cases.\nFor a more complex setup, the JAR file published in the Maven repository should be used to build a custom Keycloak\nimage.\nThe docker-compose configuration below allows spinning up a basic Keycloak instance with the plugin enabled as part of\nthe Identus cloud agent stack.\n\n```yaml\nservices:\n  keycloak-oid4vci-issuer:\n    image: ghcr.io/hyperledger/identus-keycloak-plugins:0.1.0\n    ports:\n      - \"9980:8080\"\n    command:\n      - start-dev\n      - --features=preview\n      - --health-enabled=true\n      - --hostname-url=http://localhost:9980\n      - --hostname-admin-url=http://localhost:9980\n    environment:\n      IDENTUS_URL: \u003cAGENT_URL\u003e # point to cloud agent instance\n      KEYCLOAK_ADMIN: admin\n      KEYCLOAK_ADMIN_PASSWORD: admin\n    restart: always\n\n  # Identus cloud agent and other services below\n```\n\n### Customized Keycloak plugin image\n\nIn many cases, Keycloak customization is necessary for branding or to meet custom\nauthentication and authorization requirements. The default plugin image can be used\nin conjunction with docker multi-stage builds to extract the Keycloak plugin JARs and\ncreate a customized Keycloak image.\n\nThe image contains plugin JARs in the `/opt/keycloak/providers` directory\n\nExample `Dockerfile`\n\n```\nFROM ghcr.io/hyperledger/identus-keycloak-plugins:0.1.0 AS dist\n\nFROM quay.io/keycloak/keycloak:23.0.7\nCOPY --from=dist /opt/keycloak/providers/\u003cPLUGIN_FILE\u003e.jar /opt/keycloak/providers/\u003cPLUGIN_FILE\u003e.jar\n\n# more steps to customize assets / themes / providers\n\nRUN /opt/keycloak/bin/kc.sh build\nENTRYPOINT [ \"/opt/keycloak/bin/kc.sh\" ]\n```\n\nPlease refer to the official [Keycloak documentation](https://www.keycloak.org/server/containers)\nfor customization using JAR providers.\n\n## Using published JAR\n\nEach plugin is available individually\non [Github maven packages](https://github.com/orgs/hyperledger/packages?repo_name=identus-keycloak-plugins),\nfor easy integration with your build process and fine-grained control over which plugins are included when customizing\nKeycloak.\n\nPlease refer to the official [Keycloak documentation](https://www.keycloak.org/server/containers)\nfor customization using JAR providers.\n\n# Example\n\n- https://github.com/hyperledger/identus-cloud-agent/tree/main/examples/st-oid4vci\n\n# Available Plugins\n\n## `identus-keycloak-oid4vci`\n\nExtends Keycloak for integration with Hyperledger Identus Cloud Agent\nin [OID4VCI](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html) flow.\nThe Keycloak instance to use this is the Issuer Authorization Server where the plugin takes care of\nthe OpenID extension in the issuance flow.\nThe plugin supports the Authorization Endpoint and Token Endpoint according to the specification.\nAdditionally, the plugin communicates with the cloud agent during holder authorization to coordinate the issuance\nsession.\n\n### Features\n\n- [Authorization code flow](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-authorization-code-flow)\n    - _AuthorizationRequest_ supported parameters\n        - [`issuer_state`](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-5.1.3-2.3)\n    - _TokenResponse_ supported parameters\n        - [`c_nonce`](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-6.2-4.1)\n        - [`c_nonce_expires_in`](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-6.2-4.2)\n- [Pre-authorized-code flow](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-pre-authorized-code-flow)\n    - Not yet supported\n\n### Environment Variables\n\n| Name          | Description                                                                                                                                              |\n|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `IDENTUS_URL` | URL of the Identus Cloud Agent to coordinate the issuance session. If the variable is not set, the TokenResponse will not contain the `nonce` parameter. |\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhyperledger-identus%2Fkeycloak-plugins","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhyperledger-identus%2Fkeycloak-plugins","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhyperledger-identus%2Fkeycloak-plugins/lists"}