@multiplatform.one/wallet 7.7.2

package/src/main/java/com/bitspur/keycloak/siwe/siu/SiuUtil.java

@@ -0,0 +1,547 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siu/SiuUtil.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * Utility functions for Sign-In With Sui (SIU) authentication.
+ */
+
+package com.bitspur.keycloak.siwe.siu;
+
+import com.bitspur.keycloak.siwe.Errors.SiweKeycloakException;
+import com.bitspur.keycloak.siwe.SiweSession;
+import com.bitspur.keycloak.siwe.jpa.nonce.SiweNonce;
+import com.bitspur.keycloak.siwe.jpa.wallet.SiweWalletAddress;
+import com.bitspur.keycloak.siwe.siu.authenticators.browser.SiuBrowserAuthenticatorFactory;
+import com.bitspur.keycloak.siwe.siu.authenticators.directgrant.SiuDirectGrantAuthenticatorFactory;
+import com.iwebpp.crypto.TweetNaclFast;
+
+import java.nio.charset.StandardCharsets;
+import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.List;
+
+import jakarta.persistence.EntityManager;
+import jakarta.persistence.NoResultException;
+import jakarta.persistence.TypedQuery;
+import jakarta.ws.rs.core.Cookie;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.MultivaluedMap;
+
+import org.jboss.logging.Logger;
+import org.keycloak.authentication.AuthenticationFlowContext;
+import org.keycloak.authentication.AuthenticationFlowError;
+import org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator;
+import org.keycloak.connections.jpa.JpaConnectionProvider;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.forms.login.LoginFormsProvider;
+import org.keycloak.http.HttpRequest;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.models.AuthenticationFlowModel;
+import org.keycloak.models.AuthenticatorConfigModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.services.ServicesLogger;
+import org.keycloak.services.messages.Messages;
+import org.keycloak.userprofile.UserProfile;
+import org.keycloak.userprofile.UserProfileContext;
+import org.keycloak.userprofile.UserProfileProvider;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+public class SiuUtil {
+    private static final Logger logger = Logger.getLogger(SiuUtil.class);
+    private static final SecureRandom random = new SecureRandom();
+
+    /**
+     * Address type for Sui wallets.
+     */
+    public static final String SUI_ADDRESS_TYPE = "sui";
+
+    /**
+     * Cookie name for SIU session.
+     */
+    public static final String KEYCLOAK_SESSION_SIU = "KEYCLOAK_SESSION_SIU";
+
+    // Hex characters for decoding
+    private static final char[] HEX_CHARS = "0123456789abcdef".toCharArray();
+
+    /**
+     * Decodes a hex encoded string to bytes.
+     * Handles both lowercase and uppercase hex, with or without 0x prefix.
+     *
+     * @param hex Hex encoded string
+     * @return Decoded bytes
+     * @throws SiweKeycloakException if decoding fails
+     */
+    public static byte[] decodeHex(String hex) throws SiweKeycloakException {
+        if (hex == null || hex.isEmpty()) {
+            throw new SiweKeycloakException("Cannot decode null or empty hex string");
+        }
+
+        // Remove 0x prefix if present
+        if (hex.startsWith("0x") || hex.startsWith("0X")) {
+            hex = hex.substring(2);
+        }
+
+        if (hex.length() % 2 != 0) {
+            throw new SiweKeycloakException("Invalid hex string length: must be even");
+        }
+
+        byte[] result = new byte[hex.length() / 2];
+        for (int i = 0; i < hex.length(); i += 2) {
+            int high = Character.digit(hex.charAt(i), 16);
+            int low = Character.digit(hex.charAt(i + 1), 16);
+            if (high == -1 || low == -1) {
+                throw new SiweKeycloakException("Invalid hex character at position " + i);
+            }
+            result[i / 2] = (byte) ((high << 4) + low);
+        }
+        return result;
+    }
+
+    /**
+     * Encodes bytes to hex string with 0x prefix.
+     *
+     * @param bytes Bytes to encode
+     * @return Hex encoded string with 0x prefix
+     */
+    public static String encodeHex(byte[] bytes) {
+        StringBuilder sb = new StringBuilder("0x");
+        for (byte b : bytes) {
+            sb.append(HEX_CHARS[(b >> 4) & 0xF]);
+            sb.append(HEX_CHARS[b & 0xF]);
+        }
+        return sb.toString();
+    }
+
+    /**
+     * Verifies an ed25519 signature for a SIU message.
+     *
+     * @param message The message that was signed
+     * @param signature The Base64-encoded signature
+     * @param publicKey The hex-encoded public key (Sui address, with 0x prefix)
+     * @return true if the signature is valid
+     * @throws SiweKeycloakException if verification fails
+     */
+    public static boolean verifySignature(String message, String signature, String publicKey)
+            throws SiweKeycloakException {
+        try {
+            byte[] messageBytes = message.getBytes(StandardCharsets.UTF_8);
+            byte[] signatureBytes = Base64.getDecoder().decode(signature);
+            byte[] publicKeyBytes = decodeHex(publicKey);
+
+            // Verify signature length (64 bytes for ed25519)
+            if (signatureBytes.length != 64) {
+                throw new SiweKeycloakException("Invalid signature length: expected 64 bytes, got " + signatureBytes.length);
+            }
+
+            // Verify public key length (32 bytes for ed25519)
+            if (publicKeyBytes.length != 32) {
+                throw new SiweKeycloakException("Invalid public key length: expected 32 bytes, got " + publicKeyBytes.length);
+            }
+
+            // Use TweetNaCl for ed25519 signature verification
+            // Create a Signature instance with the public key for verification
+            TweetNaclFast.Signature sig = new TweetNaclFast.Signature(publicKeyBytes, null);
+            return sig.detached_verify(messageBytes, signatureBytes);
+        } catch (SiweKeycloakException e) {
+            throw e;
+        } catch (IllegalArgumentException e) {
+            throw new SiweKeycloakException("Invalid Base64 encoding for signature");
+        } catch (Exception e) {
+            throw new SiweKeycloakException("Signature verification failed: " + e.getMessage());
+        }
+    }
+
+    /**
+     * Verifies SIU credentials including signature, nonce, and domain.
+     *
+     * @param session Keycloak session
+     * @param configModel Authenticator config
+     * @param siuCredentials SIU credentials to verify
+     * @return true if credentials are valid
+     * @throws SiweKeycloakException if verification fails
+     */
+    public static Boolean verifySiuCredentials(KeycloakSession session,
+            AuthenticatorConfigModel configModel, SiuCredentials siuCredentials)
+            throws SiweKeycloakException {
+        HttpRequest httpRequest = session.getContext().getHttpRequest();
+
+        // Get and validate nonce
+        String nonce = getNonce(session);
+        if (nonce == null) {
+            throw new SiweKeycloakException("Missing nonce in session");
+        }
+
+        // Verify nonce matches
+        if (!nonce.equals(siuCredentials.message.getNonce())) {
+            throw new SiweKeycloakException("Nonce mismatch");
+        }
+
+        // Reconstruct the message and verify signature
+        String reconstructedMessage = siuCredentials.message.toMessage();
+        String address = siuCredentials.message.getAddress();
+
+        return verifySignature(reconstructedMessage, siuCredentials.signature, address);
+    }
+
+    /**
+     * Finds an existing user by wallet address or creates a new user if none exists.
+     *
+     * @param context Authentication flow context
+     * @param siuCredentials SIU credentials
+     * @return UserModel or null if creation/lookup fails
+     * @throws SiweKeycloakException if an error occurs
+     */
+    public static UserModel findOrCreateUser(AuthenticationFlowContext context,
+            SiuCredentials siuCredentials) throws SiweKeycloakException {
+        return findOrCreateUser(context, siuCredentials, true);
+    }
+
+    /**
+     * Finds an existing user by wallet address or creates a new user if none exists.
+     *
+     * @param context Authentication flow context
+     * @param siuCredentials SIU credentials
+     * @param failureChallenge Whether to issue a failure challenge on error
+     * @return UserModel or null if creation/lookup fails
+     * @throws SiweKeycloakException if an error occurs
+     */
+    public static UserModel findOrCreateUser(AuthenticationFlowContext context,
+            SiuCredentials siuCredentials, Boolean failureChallenge) throws SiweKeycloakException {
+        String address = siuCredentials.message.getAddress();
+        if (address == null) {
+            if (failureChallenge) {
+                context.getEvent().error(Errors.USER_NOT_FOUND);
+                LoginFormsProvider form = context.form();
+                form.setExecution(context.getExecution().getId());
+                form.setError(Messages.INVALID_USER);
+                context.failureChallenge(AuthenticationFlowError.INVALID_USER, form.createLoginUsernamePassword());
+            }
+            return null;
+        }
+
+        UserModel user = null;
+        EntityManager entityManager = context.getSession().getProvider(JpaConnectionProvider.class).getEntityManager();
+
+        try {
+            // Look up existing user by Sui wallet address
+            List<SiweWalletAddress> wallets = entityManager
+                    .createNamedQuery("findByRealmAddressType", SiweWalletAddress.class)
+                    .setParameter("realmId", context.getRealm().getId())
+                    .setParameter("address", address.trim().toLowerCase())
+                    .setParameter("addressType", SUI_ADDRESS_TYPE)
+                    .getResultList();
+
+            if (!wallets.isEmpty()) {
+                user = context.getSession().users().getUserById(context.getRealm(), wallets.get(0).getUserId());
+            }
+        } catch (ModelDuplicateException mde) {
+            if (failureChallenge) {
+                ServicesLogger.LOGGER.modelDuplicateException(mde);
+                context.getEvent().error(Errors.USERNAME_IN_USE);
+                LoginFormsProvider form = context.form();
+                form.setError(Messages.USERNAME_EXISTS);
+                context.failureChallenge(AuthenticationFlowError.INVALID_USER, form.createLoginUsernamePassword());
+            }
+            return null;
+        }
+
+        // If no existing user found, create a new one
+        if (user == null) {
+            if (verifySiuCredentials(context.getSession(), context.getAuthenticatorConfig(), siuCredentials)) {
+                KeycloakSession session = context.getSession();
+                UserProfileProvider profileProvider = session.getProvider(UserProfileProvider.class);
+                MultivaluedMap<String, String> formData = new MultivaluedHashMap<>();
+                String username = generateRandomUsername(session, context.getRealm());
+                context.getEvent().detail(Details.USERNAME, username);
+                context.getAuthenticationSession().setAuthNote(AbstractUsernameFormAuthenticator.ATTEMPTED_USERNAME, username);
+                formData.add("username", username);
+                UserProfile profile = profileProvider.create(UserProfileContext.REGISTRATION, formData);
+                user = profile.create();
+                user.setEnabled(true);
+
+                // Add Sui wallet address (normalized to lowercase)
+                SiweWalletAddress wallet = new SiweWalletAddress();
+                wallet.setAddress(address.trim().toLowerCase());
+                wallet.setAddressType(SUI_ADDRESS_TYPE);
+                wallet.setUserId(user.getId());
+                wallet.setRealmId(context.getRealm().getId());
+                entityManager.persist(wallet);
+
+                return user;
+            }
+
+            if (failureChallenge) {
+                context.getEvent().error(Errors.USER_NOT_FOUND);
+                LoginFormsProvider form = context.form();
+                form.setExecution(context.getExecution().getId());
+                form.setError(Messages.INVALID_USER);
+                context.failureChallenge(AuthenticationFlowError.INVALID_USER, form.createLoginUsernamePassword());
+            }
+            return null;
+        }
+
+        String username = user.getUsername();
+        context.getEvent().detail(Details.USERNAME, username);
+        context.getAuthenticationSession().setAuthNote(AbstractUsernameFormAuthenticator.ATTEMPTED_USERNAME, username);
+        return user;
+    }
+
+    /**
+     * Verifies that an existing user exists for the given wallet address.
+     *
+     * @param session Keycloak session
+     * @param configModel Authenticator config
+     * @param siuCredentials SIU credentials
+     * @return true if user exists
+     */
+    public static Boolean verifyExistingUser(KeycloakSession session,
+            AuthenticatorConfigModel configModel, SiuCredentials siuCredentials) {
+        String address = siuCredentials.message.getAddress().trim().toLowerCase();
+        RealmModel realm = session.getContext().getRealm();
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        List<SiweWalletAddress> wallets = entityManager
+                .createNamedQuery("findByRealmAddressType", SiweWalletAddress.class)
+                .setParameter("realmId", realm.getId())
+                .setParameter("address", address)
+                .setParameter("addressType", SUI_ADDRESS_TYPE)
+                .getResultList();
+        return !wallets.isEmpty();
+    }
+
+    /**
+     * Performs full verification including existing user, credentials, etc.
+     */
+    public static Boolean verify(KeycloakSession session, AuthenticatorConfigModel configModel,
+            SiuCredentials siuCredentials) throws SiweKeycloakException {
+        return verifyExistingUser(session, configModel, siuCredentials)
+                && verifySiuCredentials(session, configModel, siuCredentials);
+    }
+
+    /**
+     * Generates a SIU session with a new nonce.
+     */
+    public static SiweSession generateSiuSession(KeycloakSession session) {
+        String nonce = generateNonce();
+        String sessionKey = generateSessionKey(session.getContext().getRealm().getName());
+        setNonce(session, sessionKey, nonce);
+        return new SiweSession(sessionKey, nonce);
+    }
+
+    /**
+     * Gets the authenticator config for SIU.
+     */
+    public static AuthenticatorConfigModel getAuthenticatorConfig(KeycloakSession session, Boolean isDirectGrantFlow) {
+        RealmModel realm = session.getContext().getRealm();
+        AuthenticationFlowModel flow = realm.getBrowserFlow();
+        if (isDirectGrantFlow) {
+            flow = realm.getDirectGrantFlow();
+        }
+        AuthenticationExecutionModel execution = realm.getAuthenticationExecutionsStream(flow.getId())
+                .filter(e -> {
+                    String authenticator = e.getAuthenticator();
+                    return authenticator != null
+                            && authenticator.equals(isDirectGrantFlow ? SiuDirectGrantAuthenticatorFactory.ID
+                                    : SiuBrowserAuthenticatorFactory.ID);
+                })
+                .findFirst().orElse(null);
+        if (execution == null) {
+            return null;
+        }
+        return realm.getAuthenticatorConfigById(execution.getAuthenticatorConfig());
+    }
+
+    /**
+     * Gets the session key from the SIU cookie.
+     */
+    public static String getSessionKey(KeycloakSession session) throws SiweKeycloakException {
+        HttpRequest request = session.getContext().getHttpRequest();
+        Cookie cookie = request.getHttpHeaders().getCookies().get(KEYCLOAK_SESSION_SIU);
+        String sessionKey = null;
+        if (cookie != null) {
+            sessionKey = cookie.getValue();
+        }
+        if (sessionKey == null) {
+            throw new SiweKeycloakException("missing siu session");
+        }
+        return sessionKey;
+    }
+
+    /**
+     * Gets the nonce from the session.
+     */
+    public static String getNonce(KeycloakSession session) throws SiweKeycloakException {
+        String sessionKey = getSessionKey(session);
+        return getNonce(session, sessionKey);
+    }
+
+    /**
+     * Gets the nonce for a specific session key.
+     */
+    public static String getNonce(KeycloakSession session, String key) {
+        SiweNonce siweNonce = getSiweNonce(session, key);
+        if (siweNonce == null) {
+            return null;
+        }
+        return siweNonce.getNonce();
+    }
+
+    /**
+     * Sets the nonce for a session key.
+     */
+    public static String setNonce(KeycloakSession session, String key, String nonce) {
+        RealmModel realm = session.getContext().getRealm();
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        SiweNonce siweNonce = getSiweNonce(session, key);
+        if (siweNonce == null) {
+            siweNonce = new SiweNonce();
+            siweNonce.setKey(key);
+            siweNonce.setRealmId(realm.getId());
+        }
+        siweNonce.setNonce(nonce);
+        entityManager.merge(siweNonce);
+        return nonce;
+    }
+
+    /**
+     * Removes a nonce from the session.
+     */
+    public static Void removeNonce(KeycloakSession session, String key) {
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        SiweNonce siweNonce = getSiweNonce(session, key);
+        if (siweNonce == null) {
+            return null;
+        }
+        entityManager.remove(siweNonce);
+        return null;
+    }
+
+    /**
+     * Finds a user by Sui wallet address.
+     */
+    public static UserModel findUserByWalletAddress(KeycloakSession session, String address) {
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        try {
+            TypedQuery<SiweWalletAddress> query = entityManager.createNamedQuery("findByRealmAddressType",
+                    SiweWalletAddress.class);
+            query.setParameter("address", address.trim().toLowerCase());
+            query.setParameter("realmId", session.getContext().getRealm().getId());
+            query.setParameter("addressType", SUI_ADDRESS_TYPE);
+            List<SiweWalletAddress> wallets = query.getResultList();
+            if (!wallets.isEmpty()) {
+                return session.users().getUserById(session.getContext().getRealm(), wallets.get(0).getUserId());
+            }
+            return null;
+        } catch (NoResultException e) {
+            return null;
+        }
+    }
+
+    /**
+     * Adds a Sui wallet address to a user.
+     */
+    public static boolean addWalletAddress(KeycloakSession session, UserModel user, String address) {
+        String normalizedAddress = address.trim().toLowerCase();
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        TypedQuery<SiweWalletAddress> query = entityManager.createNamedQuery("findByRealmAddressType",
+                SiweWalletAddress.class);
+        query.setParameter("address", normalizedAddress);
+        query.setParameter("realmId", session.getContext().getRealm().getId());
+        query.setParameter("addressType", SUI_ADDRESS_TYPE);
+        List<SiweWalletAddress> existingWallets = query.getResultList();
+        for (SiweWalletAddress wallet : existingWallets) {
+            if (wallet.getUserId().equals(user.getId())) {
+                return false;
+            }
+        }
+        SiweWalletAddress wallet = new SiweWalletAddress();
+        wallet.setAddress(normalizedAddress);
+        wallet.setAddressType(SUI_ADDRESS_TYPE);
+        wallet.setUserId(user.getId());
+        wallet.setRealmId(session.getContext().getRealm().getId());
+        entityManager.persist(wallet);
+        return true;
+    }
+
+    /**
+     * Removes a Sui wallet address.
+     */
+    public static boolean removeWalletAddress(KeycloakSession session, String address) {
+        String normalizedAddress = address.trim().toLowerCase();
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        TypedQuery<SiweWalletAddress> query = entityManager.createNamedQuery("findByRealmAddressType",
+                SiweWalletAddress.class);
+        query.setParameter("address", normalizedAddress);
+        query.setParameter("realmId", session.getContext().getRealm().getId());
+        query.setParameter("addressType", SUI_ADDRESS_TYPE);
+        try {
+            List<SiweWalletAddress> wallets = query.getResultList();
+            if (!wallets.isEmpty()) {
+                entityManager.remove(wallets.get(0));
+                return true;
+            }
+            return false;
+        } catch (NoResultException e) {
+            return false;
+        }
+    }
+
+    /**
+     * Gets all Sui wallet addresses for a user.
+     */
+    public static List<SiweWalletAddress> getWalletAddresses(KeycloakSession session, UserModel user) {
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        TypedQuery<SiweWalletAddress> query = entityManager.createNamedQuery("findByUserId", SiweWalletAddress.class);
+        query.setParameter("userId", user.getId());
+        List<SiweWalletAddress> allWallets = query.getResultList();
+        // Filter to only Sui wallets
+        List<SiweWalletAddress> suiWallets = new ArrayList<>();
+        for (SiweWalletAddress wallet : allWallets) {
+            if (SUI_ADDRESS_TYPE.equals(wallet.getAddressType())) {
+                suiWallets.add(wallet);
+            }
+        }
+        return suiWallets;
+    }
+
+    // Private helper methods
+
+    private static SiweNonce getSiweNonce(KeycloakSession session, String key) {
+        RealmModel realm = session.getContext().getRealm();
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        SiweNonce siweNonce = entityManager.createNamedQuery("findByRealmKey", SiweNonce.class)
+                .setParameter("key", key)
+                .setParameter("realmId", realm.getId())
+                .getResultList().stream().findFirst().orElse(null);
+        return siweNonce;
+    }
+
+    private static String generateNonce() {
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(random.generateSeed(8))
+                .replaceAll("[^A-Za-z0-9]", "0")
+                .substring(0, 8);
+    }
+
+    private static String generateSessionKey(String realmName) {
+        byte[] keyBytes = new byte[32];
+        random.nextBytes(keyBytes);
+        return realmName + "/" + (Base64.getEncoder().encodeToString(keyBytes));
+    }
+
+    private static String generateRandomUsername(KeycloakSession session, RealmModel realm) {
+        while (true) {
+            String username = String.format("sui_%010d", Math.abs(random.nextLong() % 10000000000L));
+            if (KeycloakModelUtils.findUserByNameOrEmail(session, realm, username) == null) {
+                return username;
+            }
+        }
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siu/authenticators/browser/SiuBrowserAuthenticator.java

@@ -0,0 +1,112 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siu/authenticators/browser/SiuBrowserAuthenticator.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * Browser authenticator for Sign-In With Sui (SIU).
+ */
+
+package com.bitspur.keycloak.siwe.siu.authenticators.browser;
+
+import com.bitspur.keycloak.siwe.Errors.SiweKeycloakException;
+import com.bitspur.keycloak.siwe.siu.SiuCredentials;
+import com.bitspur.keycloak.siwe.siu.SiuUtil;
+
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
+
+import org.jboss.logging.Logger;
+import org.keycloak.authentication.AuthenticationFlowContext;
+import org.keycloak.authentication.AuthenticationFlowError;
+import org.keycloak.authentication.Authenticator;
+import org.keycloak.forms.login.LoginFormsProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.services.messages.Messages;
+
+/**
+ * Browser-based SIU authenticator.
+ * Handles the login form submission with Sui wallet signature.
+ */
+public class SiuBrowserAuthenticator implements Authenticator {
+    private static final Logger logger = Logger.getLogger(SiuBrowserAuthenticator.class);
+
+    @Override
+    public void authenticate(AuthenticationFlowContext context) {
+        // Display the SIU login form
+        LoginFormsProvider form = context.form();
+        form.setExecution(context.getExecution().getId());
+        Response response = form.createLoginUsernamePassword();
+        context.challenge(response);
+    }
+
+    @Override
+    public void action(AuthenticationFlowContext context) {
+        MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();
+        String signature = formData.getFirst("username"); // Signature is passed as username
+        String message = formData.getFirst("password");   // Base64 SIU message is passed as password
+
+        if (signature == null || signature.isEmpty() || message == null || message.isEmpty()) {
+            context.getEvent().error("missing_credentials");
+            LoginFormsProvider form = context.form();
+            form.setExecution(context.getExecution().getId());
+            form.setError(Messages.INVALID_USER);
+            context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, form.createLoginUsernamePassword());
+            return;
+        }
+
+        try {
+            SiuCredentials siuCredentials = new SiuCredentials(signature, message);
+            UserModel user = SiuUtil.findOrCreateUser(context, siuCredentials, true);
+
+            if (user == null) {
+                // findOrCreateUser already issued failure challenge
+                return;
+            }
+
+            // Verify the credentials
+            if (!SiuUtil.verifySiuCredentials(context.getSession(), context.getAuthenticatorConfig(), siuCredentials)) {
+                context.getEvent().error("invalid_signature");
+                LoginFormsProvider form = context.form();
+                form.setExecution(context.getExecution().getId());
+                form.setError(Messages.INVALID_USER);
+                context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, form.createLoginUsernamePassword());
+                return;
+            }
+
+            context.setUser(user);
+            context.success();
+        } catch (SiweKeycloakException e) {
+            logger.error("SIU authentication error", e);
+            context.getEvent().error("siu_error");
+            LoginFormsProvider form = context.form();
+            form.setExecution(context.getExecution().getId());
+            form.setError(e.getMessage());
+            context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, form.createLoginUsernamePassword());
+        }
+    }
+
+    @Override
+    public boolean requiresUser() {
+        return false;
+    }
+
+    @Override
+    public boolean configuredFor(KeycloakSession session, RealmModel realm, UserModel user) {
+        return true;
+    }
+
+    @Override
+    public void setRequiredActions(KeycloakSession session, RealmModel realm, UserModel user) {
+        // No required actions
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+}