@multiplatform.one/wallet 7.7.2

package/src/main/java/com/bitspur/keycloak/siwe/siws/SiwsUtil.java

@@ -0,0 +1,564 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siws/SiwsUtil.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * Utility functions for Sign-In With Solana (SIWS) authentication.
+ */
+
+package com.bitspur.keycloak.siwe.siws;
+
+import com.bitspur.keycloak.siwe.Errors.SiweKeycloakException;
+import com.bitspur.keycloak.siwe.SiweSession;
+import com.bitspur.keycloak.siwe.SiweUtil;
+import com.bitspur.keycloak.siwe.jpa.nonce.SiweNonce;
+import com.bitspur.keycloak.siwe.jpa.wallet.SiweWalletAddress;
+import com.bitspur.keycloak.siwe.siws.authenticators.browser.SiwsBrowserAuthenticatorFactory;
+import com.bitspur.keycloak.siwe.siws.authenticators.directgrant.SiwsDirectGrantAuthenticatorFactory;
+import com.iwebpp.crypto.TweetNaclFast;
+
+import java.nio.charset.StandardCharsets;
+import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import jakarta.persistence.EntityManager;
+import jakarta.persistence.NoResultException;
+import jakarta.persistence.TypedQuery;
+import jakarta.ws.rs.core.Cookie;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.MultivaluedMap;
+
+import org.jboss.logging.Logger;
+import org.keycloak.authentication.AuthenticationFlowContext;
+import org.keycloak.authentication.AuthenticationFlowError;
+import org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator;
+import org.keycloak.connections.jpa.JpaConnectionProvider;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.forms.login.LoginFormsProvider;
+import org.keycloak.http.HttpRequest;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.models.AuthenticationFlowModel;
+import org.keycloak.models.AuthenticatorConfigModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.services.ServicesLogger;
+import org.keycloak.services.messages.Messages;
+import org.keycloak.userprofile.UserProfile;
+import org.keycloak.userprofile.UserProfileContext;
+import org.keycloak.userprofile.UserProfileProvider;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+public class SiwsUtil {
+    private static final Logger logger = Logger.getLogger(SiwsUtil.class);
+    private static final SecureRandom random = new SecureRandom();
+
+    /**
+     * Address type for Solana wallets.
+     */
+    public static final String SOLANA_ADDRESS_TYPE = "solana";
+
+    /**
+     * Cookie name for SIWS session.
+     */
+    public static final String KEYCLOAK_SESSION_SIWS = "KEYCLOAK_SESSION_SIWS";
+
+    // Base58 alphabet used by Solana
+    private static final String BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+    private static final int[] BASE58_INDEXES = new int[128];
+
+    static {
+        for (int i = 0; i < BASE58_INDEXES.length; i++) {
+            BASE58_INDEXES[i] = -1;
+        }
+        for (int i = 0; i < BASE58_ALPHABET.length(); i++) {
+            BASE58_INDEXES[BASE58_ALPHABET.charAt(i)] = i;
+        }
+    }
+
+    /**
+     * Decodes a Base58 encoded string to bytes.
+     *
+     * @param input Base58 encoded string
+     * @return Decoded bytes
+     * @throws SiweKeycloakException if decoding fails
+     */
+    public static byte[] decodeBase58(String input) throws SiweKeycloakException {
+        if (input == null || input.isEmpty()) {
+            throw new SiweKeycloakException("Cannot decode null or empty Base58 string");
+        }
+
+        // Count leading zeros
+        int zeros = 0;
+        for (int i = 0; i < input.length() && input.charAt(i) == '1'; i++) {
+            zeros++;
+        }
+
+        // Allocate enough space for the decoded output
+        byte[] b256 = new byte[input.length()];
+        int outputLen = 0;
+
+        for (int i = zeros; i < input.length(); i++) {
+            char c = input.charAt(i);
+            if (c >= 128 || BASE58_INDEXES[c] == -1) {
+                throw new SiweKeycloakException("Invalid Base58 character: " + c);
+            }
+
+            int carry = BASE58_INDEXES[c];
+            for (int j = 0; j < outputLen || carry != 0; j++) {
+                carry += 58 * (j < outputLen ? b256[j] & 0xFF : 0);
+                b256[j] = (byte) (carry % 256);
+                carry /= 256;
+                if (j >= outputLen) {
+                    outputLen = j + 1;
+                }
+            }
+        }
+
+        // Skip leading zeros in b256
+        int skipZeros = 0;
+        while (skipZeros < outputLen && b256[outputLen - 1 - skipZeros] == 0) {
+            skipZeros++;
+        }
+
+        // Build result with leading zeros
+        byte[] result = new byte[zeros + outputLen - skipZeros];
+        for (int i = 0; i < zeros; i++) {
+            result[i] = 0;
+        }
+        for (int i = 0; i < outputLen - skipZeros; i++) {
+            result[zeros + i] = b256[outputLen - 1 - skipZeros - i];
+        }
+
+        return result;
+    }
+
+    /**
+     * Verifies an ed25519 signature for a SIWS message.
+     *
+     * @param message The message that was signed
+     * @param signature The Base58-encoded signature
+     * @param publicKey The Base58-encoded public key (Solana address)
+     * @return true if the signature is valid
+     * @throws SiweKeycloakException if verification fails
+     */
+    public static boolean verifySignature(String message, String signature, String publicKey)
+            throws SiweKeycloakException {
+        try {
+            byte[] messageBytes = message.getBytes(StandardCharsets.UTF_8);
+            byte[] signatureBytes = decodeBase58(signature);
+            byte[] publicKeyBytes = decodeBase58(publicKey);
+
+            // Verify signature length (64 bytes for ed25519)
+            if (signatureBytes.length != 64) {
+                throw new SiweKeycloakException("Invalid signature length: expected 64 bytes, got " + signatureBytes.length);
+            }
+
+            // Verify public key length (32 bytes for ed25519)
+            if (publicKeyBytes.length != 32) {
+                throw new SiweKeycloakException("Invalid public key length: expected 32 bytes, got " + publicKeyBytes.length);
+            }
+
+            // Use TweetNaCl for ed25519 signature verification
+            // Create a Signature instance with the public key for verification
+            TweetNaclFast.Signature sig = new TweetNaclFast.Signature(publicKeyBytes, null);
+            return sig.detached_verify(messageBytes, signatureBytes);
+        } catch (SiweKeycloakException e) {
+            throw e;
+        } catch (Exception e) {
+            throw new SiweKeycloakException("Signature verification failed: " + e.getMessage());
+        }
+    }
+
+    /**
+     * Verifies SIWS credentials including signature, nonce, and domain.
+     *
+     * @param session Keycloak session
+     * @param configModel Authenticator config
+     * @param siwsCredentials SIWS credentials to verify
+     * @return true if credentials are valid
+     * @throws SiweKeycloakException if verification fails
+     */
+    public static Boolean verifySiwsCredentials(KeycloakSession session,
+            AuthenticatorConfigModel configModel, SiwsCredentials siwsCredentials)
+            throws SiweKeycloakException {
+        HttpRequest httpRequest = session.getContext().getHttpRequest();
+
+        // Get and validate nonce
+        String nonce = getNonce(session);
+        if (nonce == null) {
+            throw new SiweKeycloakException("Missing nonce in session");
+        }
+
+        // Verify nonce matches
+        if (!nonce.equals(siwsCredentials.message.getNonce())) {
+            throw new SiweKeycloakException("Nonce mismatch");
+        }
+
+        // Reconstruct the message and verify signature
+        String reconstructedMessage = siwsCredentials.message.toMessage();
+        String address = siwsCredentials.message.getAddress();
+
+        return verifySignature(reconstructedMessage, siwsCredentials.signature, address);
+    }
+
+    /**
+     * Finds an existing user by wallet address or creates a new user if none exists.
+     *
+     * @param context Authentication flow context
+     * @param siwsCredentials SIWS credentials
+     * @return UserModel or null if creation/lookup fails
+     * @throws SiweKeycloakException if an error occurs
+     */
+    public static UserModel findOrCreateUser(AuthenticationFlowContext context,
+            SiwsCredentials siwsCredentials) throws SiweKeycloakException {
+        return findOrCreateUser(context, siwsCredentials, true);
+    }
+
+    /**
+     * Finds an existing user by wallet address or creates a new user if none exists.
+     *
+     * @param context Authentication flow context
+     * @param siwsCredentials SIWS credentials
+     * @param failureChallenge Whether to issue a failure challenge on error
+     * @return UserModel or null if creation/lookup fails
+     * @throws SiweKeycloakException if an error occurs
+     */
+    public static UserModel findOrCreateUser(AuthenticationFlowContext context,
+            SiwsCredentials siwsCredentials, Boolean failureChallenge) throws SiweKeycloakException {
+        String address = siwsCredentials.message.getAddress();
+        if (address == null) {
+            if (failureChallenge) {
+                context.getEvent().error(Errors.USER_NOT_FOUND);
+                LoginFormsProvider form = context.form();
+                form.setExecution(context.getExecution().getId());
+                form.setError(Messages.INVALID_USER);
+                context.failureChallenge(AuthenticationFlowError.INVALID_USER, form.createLoginUsernamePassword());
+            }
+            return null;
+        }
+
+        UserModel user = null;
+        EntityManager entityManager = context.getSession().getProvider(JpaConnectionProvider.class).getEntityManager();
+
+        try {
+            // Look up existing user by Solana wallet address
+            List<SiweWalletAddress> wallets = entityManager
+                    .createNamedQuery("findByRealmAddressType", SiweWalletAddress.class)
+                    .setParameter("realmId", context.getRealm().getId())
+                    .setParameter("address", address.trim())
+                    .setParameter("addressType", SOLANA_ADDRESS_TYPE)
+                    .getResultList();
+
+            if (!wallets.isEmpty()) {
+                user = context.getSession().users().getUserById(context.getRealm(), wallets.get(0).getUserId());
+            }
+        } catch (ModelDuplicateException mde) {
+            if (failureChallenge) {
+                ServicesLogger.LOGGER.modelDuplicateException(mde);
+                context.getEvent().error(Errors.USERNAME_IN_USE);
+                LoginFormsProvider form = context.form();
+                form.setError(Messages.USERNAME_EXISTS);
+                context.failureChallenge(AuthenticationFlowError.INVALID_USER, form.createLoginUsernamePassword());
+            }
+            return null;
+        }
+
+        // If no existing user found, create a new one
+        if (user == null) {
+            if (verifySiwsCredentials(context.getSession(), context.getAuthenticatorConfig(), siwsCredentials)) {
+                KeycloakSession session = context.getSession();
+                UserProfileProvider profileProvider = session.getProvider(UserProfileProvider.class);
+                MultivaluedMap<String, String> formData = new MultivaluedHashMap<>();
+                String username = generateRandomUsername(session, context.getRealm());
+                context.getEvent().detail(Details.USERNAME, username);
+                context.getAuthenticationSession().setAuthNote(AbstractUsernameFormAuthenticator.ATTEMPTED_USERNAME, username);
+                formData.add("username", username);
+                UserProfile profile = profileProvider.create(UserProfileContext.REGISTRATION, formData);
+                user = profile.create();
+                user.setEnabled(true);
+
+                // Add Solana wallet address
+                SiweWalletAddress wallet = new SiweWalletAddress();
+                wallet.setAddress(address.trim());
+                wallet.setAddressType(SOLANA_ADDRESS_TYPE);
+                wallet.setUserId(user.getId());
+                wallet.setRealmId(context.getRealm().getId());
+                entityManager.persist(wallet);
+
+                return user;
+            }
+
+            if (failureChallenge) {
+                context.getEvent().error(Errors.USER_NOT_FOUND);
+                LoginFormsProvider form = context.form();
+                form.setExecution(context.getExecution().getId());
+                form.setError(Messages.INVALID_USER);
+                context.failureChallenge(AuthenticationFlowError.INVALID_USER, form.createLoginUsernamePassword());
+            }
+            return null;
+        }
+
+        String username = user.getUsername();
+        context.getEvent().detail(Details.USERNAME, username);
+        context.getAuthenticationSession().setAuthNote(AbstractUsernameFormAuthenticator.ATTEMPTED_USERNAME, username);
+        return user;
+    }
+
+    /**
+     * Verifies that an existing user exists for the given wallet address.
+     *
+     * @param session Keycloak session
+     * @param configModel Authenticator config
+     * @param siwsCredentials SIWS credentials
+     * @return true if user exists
+     */
+    public static Boolean verifyExistingUser(KeycloakSession session,
+            AuthenticatorConfigModel configModel, SiwsCredentials siwsCredentials) {
+        String address = siwsCredentials.message.getAddress().trim();
+        RealmModel realm = session.getContext().getRealm();
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        List<SiweWalletAddress> wallets = entityManager
+                .createNamedQuery("findByRealmAddressType", SiweWalletAddress.class)
+                .setParameter("realmId", realm.getId())
+                .setParameter("address", address)
+                .setParameter("addressType", SOLANA_ADDRESS_TYPE)
+                .getResultList();
+        return !wallets.isEmpty();
+    }
+
+    /**
+     * Performs full verification including existing user, credentials, etc.
+     */
+    public static Boolean verify(KeycloakSession session, AuthenticatorConfigModel configModel,
+            SiwsCredentials siwsCredentials) throws SiweKeycloakException {
+        return verifyExistingUser(session, configModel, siwsCredentials)
+                && verifySiwsCredentials(session, configModel, siwsCredentials);
+    }
+
+    /**
+     * Generates a SIWS session with a new nonce.
+     */
+    public static SiweSession generateSiwsSession(KeycloakSession session) {
+        String nonce = generateNonce();
+        String sessionKey = generateSessionKey(session.getContext().getRealm().getName());
+        setNonce(session, sessionKey, nonce);
+        return new SiweSession(sessionKey, nonce);
+    }
+
+    /**
+     * Gets the authenticator config for SIWS.
+     */
+    public static AuthenticatorConfigModel getAuthenticatorConfig(KeycloakSession session, Boolean isDirectGrantFlow) {
+        RealmModel realm = session.getContext().getRealm();
+        AuthenticationFlowModel flow = realm.getBrowserFlow();
+        if (isDirectGrantFlow) {
+            flow = realm.getDirectGrantFlow();
+        }
+        AuthenticationExecutionModel execution = realm.getAuthenticationExecutionsStream(flow.getId())
+                .filter(e -> {
+                    String authenticator = e.getAuthenticator();
+                    return authenticator != null
+                            && authenticator.equals(isDirectGrantFlow ? SiwsDirectGrantAuthenticatorFactory.ID
+                                    : SiwsBrowserAuthenticatorFactory.ID);
+                })
+                .findFirst().orElse(null);
+        if (execution == null) {
+            return null;
+        }
+        return realm.getAuthenticatorConfigById(execution.getAuthenticatorConfig());
+    }
+
+    /**
+     * Gets the session key from the SIWS cookie.
+     */
+    public static String getSessionKey(KeycloakSession session) throws SiweKeycloakException {
+        HttpRequest request = session.getContext().getHttpRequest();
+        Cookie cookie = request.getHttpHeaders().getCookies().get(KEYCLOAK_SESSION_SIWS);
+        String sessionKey = null;
+        if (cookie != null) {
+            sessionKey = cookie.getValue();
+        }
+        if (sessionKey == null) {
+            throw new SiweKeycloakException("missing siws session");
+        }
+        return sessionKey;
+    }
+
+    /**
+     * Gets the nonce from the session.
+     */
+    public static String getNonce(KeycloakSession session) throws SiweKeycloakException {
+        String sessionKey = getSessionKey(session);
+        return getNonce(session, sessionKey);
+    }
+
+    /**
+     * Gets the nonce for a specific session key.
+     */
+    public static String getNonce(KeycloakSession session, String key) {
+        SiweNonce siweNonce = getSiweNonce(session, key);
+        if (siweNonce == null) {
+            return null;
+        }
+        return siweNonce.getNonce();
+    }
+
+    /**
+     * Sets the nonce for a session key.
+     */
+    public static String setNonce(KeycloakSession session, String key, String nonce) {
+        RealmModel realm = session.getContext().getRealm();
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        SiweNonce siweNonce = getSiweNonce(session, key);
+        if (siweNonce == null) {
+            siweNonce = new SiweNonce();
+            siweNonce.setKey(key);
+            siweNonce.setRealmId(realm.getId());
+        }
+        siweNonce.setNonce(nonce);
+        entityManager.merge(siweNonce);
+        return nonce;
+    }
+
+    /**
+     * Removes a nonce from the session.
+     */
+    public static Void removeNonce(KeycloakSession session, String key) {
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        SiweNonce siweNonce = getSiweNonce(session, key);
+        if (siweNonce == null) {
+            return null;
+        }
+        entityManager.remove(siweNonce);
+        return null;
+    }
+
+    /**
+     * Finds a user by Solana wallet address.
+     */
+    public static UserModel findUserByWalletAddress(KeycloakSession session, String address) {
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        try {
+            TypedQuery<SiweWalletAddress> query = entityManager.createNamedQuery("findByRealmAddressType",
+                    SiweWalletAddress.class);
+            query.setParameter("address", address.trim());
+            query.setParameter("realmId", session.getContext().getRealm().getId());
+            query.setParameter("addressType", SOLANA_ADDRESS_TYPE);
+            List<SiweWalletAddress> wallets = query.getResultList();
+            if (!wallets.isEmpty()) {
+                return session.users().getUserById(session.getContext().getRealm(), wallets.get(0).getUserId());
+            }
+            return null;
+        } catch (NoResultException e) {
+            return null;
+        }
+    }
+
+    /**
+     * Adds a Solana wallet address to a user.
+     */
+    public static boolean addWalletAddress(KeycloakSession session, UserModel user, String address) {
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        TypedQuery<SiweWalletAddress> query = entityManager.createNamedQuery("findByRealmAddressType",
+                SiweWalletAddress.class);
+        query.setParameter("address", address.trim());
+        query.setParameter("realmId", session.getContext().getRealm().getId());
+        query.setParameter("addressType", SOLANA_ADDRESS_TYPE);
+        List<SiweWalletAddress> existingWallets = query.getResultList();
+        for (SiweWalletAddress wallet : existingWallets) {
+            if (wallet.getUserId().equals(user.getId())) {
+                return false;
+            }
+        }
+        SiweWalletAddress wallet = new SiweWalletAddress();
+        wallet.setAddress(address.trim());
+        wallet.setAddressType(SOLANA_ADDRESS_TYPE);
+        wallet.setUserId(user.getId());
+        wallet.setRealmId(session.getContext().getRealm().getId());
+        entityManager.persist(wallet);
+        return true;
+    }
+
+    /**
+     * Removes a Solana wallet address.
+     */
+    public static boolean removeWalletAddress(KeycloakSession session, String address) {
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        TypedQuery<SiweWalletAddress> query = entityManager.createNamedQuery("findByRealmAddressType",
+                SiweWalletAddress.class);
+        query.setParameter("address", address.trim());
+        query.setParameter("realmId", session.getContext().getRealm().getId());
+        query.setParameter("addressType", SOLANA_ADDRESS_TYPE);
+        try {
+            List<SiweWalletAddress> wallets = query.getResultList();
+            if (!wallets.isEmpty()) {
+                entityManager.remove(wallets.get(0));
+                return true;
+            }
+            return false;
+        } catch (NoResultException e) {
+            return false;
+        }
+    }
+
+    /**
+     * Gets all Solana wallet addresses for a user.
+     */
+    public static List<SiweWalletAddress> getWalletAddresses(KeycloakSession session, UserModel user) {
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        TypedQuery<SiweWalletAddress> query = entityManager.createNamedQuery("findByUserId", SiweWalletAddress.class);
+        query.setParameter("userId", user.getId());
+        List<SiweWalletAddress> allWallets = query.getResultList();
+        // Filter to only Solana wallets
+        List<SiweWalletAddress> solanaWallets = new ArrayList<>();
+        for (SiweWalletAddress wallet : allWallets) {
+            if (SOLANA_ADDRESS_TYPE.equals(wallet.getAddressType())) {
+                solanaWallets.add(wallet);
+            }
+        }
+        return solanaWallets;
+    }
+
+    // Private helper methods
+
+    private static SiweNonce getSiweNonce(KeycloakSession session, String key) {
+        RealmModel realm = session.getContext().getRealm();
+        EntityManager entityManager = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        SiweNonce siweNonce = entityManager.createNamedQuery("findByRealmKey", SiweNonce.class)
+                .setParameter("key", key)
+                .setParameter("realmId", realm.getId())
+                .getResultList().stream().findFirst().orElse(null);
+        return siweNonce;
+    }
+
+    private static String generateNonce() {
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(random.generateSeed(8))
+                .replaceAll("[^A-Za-z0-9]", "0")
+                .substring(0, 8);
+    }
+
+    private static String generateSessionKey(String realmName) {
+        byte[] keyBytes = new byte[32];
+        random.nextBytes(keyBytes);
+        return realmName + "/" + (Base64.getEncoder().encodeToString(keyBytes));
+    }
+
+    private static String generateRandomUsername(KeycloakSession session, RealmModel realm) {
+        while (true) {
+            String username = String.format("sol_%010d", Math.abs(random.nextLong() % 10000000000L));
+            if (KeycloakModelUtils.findUserByNameOrEmail(session, realm, username) == null) {
+                return username;
+            }
+        }
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siws/authenticators/browser/SiwsBrowserAuthenticator.java

@@ -0,0 +1,112 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siws/authenticators/browser/SiwsBrowserAuthenticator.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * Browser authenticator for Sign-In With Solana (SIWS).
+ */
+
+package com.bitspur.keycloak.siwe.siws.authenticators.browser;
+
+import com.bitspur.keycloak.siwe.Errors.SiweKeycloakException;
+import com.bitspur.keycloak.siwe.siws.SiwsCredentials;
+import com.bitspur.keycloak.siwe.siws.SiwsUtil;
+
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
+
+import org.jboss.logging.Logger;
+import org.keycloak.authentication.AuthenticationFlowContext;
+import org.keycloak.authentication.AuthenticationFlowError;
+import org.keycloak.authentication.Authenticator;
+import org.keycloak.forms.login.LoginFormsProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.services.messages.Messages;
+
+/**
+ * Browser-based SIWS authenticator.
+ * Handles the login form submission with Solana wallet signature.
+ */
+public class SiwsBrowserAuthenticator implements Authenticator {
+    private static final Logger logger = Logger.getLogger(SiwsBrowserAuthenticator.class);
+
+    @Override
+    public void authenticate(AuthenticationFlowContext context) {
+        // Display the SIWS login form
+        LoginFormsProvider form = context.form();
+        form.setExecution(context.getExecution().getId());
+        Response response = form.createLoginUsernamePassword();
+        context.challenge(response);
+    }
+
+    @Override
+    public void action(AuthenticationFlowContext context) {
+        MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();
+        String signature = formData.getFirst("username"); // Signature is passed as username
+        String message = formData.getFirst("password");   // Base64 SIWS message is passed as password
+
+        if (signature == null || signature.isEmpty() || message == null || message.isEmpty()) {
+            context.getEvent().error("missing_credentials");
+            LoginFormsProvider form = context.form();
+            form.setExecution(context.getExecution().getId());
+            form.setError(Messages.INVALID_USER);
+            context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, form.createLoginUsernamePassword());
+            return;
+        }
+
+        try {
+            SiwsCredentials siwsCredentials = new SiwsCredentials(signature, message);
+            UserModel user = SiwsUtil.findOrCreateUser(context, siwsCredentials, true);
+
+            if (user == null) {
+                // findOrCreateUser already issued failure challenge
+                return;
+            }
+
+            // Verify the credentials
+            if (!SiwsUtil.verifySiwsCredentials(context.getSession(), context.getAuthenticatorConfig(), siwsCredentials)) {
+                context.getEvent().error("invalid_signature");
+                LoginFormsProvider form = context.form();
+                form.setExecution(context.getExecution().getId());
+                form.setError(Messages.INVALID_USER);
+                context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, form.createLoginUsernamePassword());
+                return;
+            }
+
+            context.setUser(user);
+            context.success();
+        } catch (SiweKeycloakException e) {
+            logger.error("SIWS authentication error", e);
+            context.getEvent().error("siws_error");
+            LoginFormsProvider form = context.form();
+            form.setExecution(context.getExecution().getId());
+            form.setError(e.getMessage());
+            context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, form.createLoginUsernamePassword());
+        }
+    }
+
+    @Override
+    public boolean requiresUser() {
+        return false;
+    }
+
+    @Override
+    public boolean configuredFor(KeycloakSession session, RealmModel realm, UserModel user) {
+        return true;
+    }
+
+    @Override
+    public void setRequiredActions(KeycloakSession session, RealmModel realm, UserModel user) {
+        // No required actions
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+}