pub struct ExternalJwtIssuer { /* private fields */ }Expand description
Verifier for one external OIDC issuer. Holds a cached JWKS plus the
claims policy (iss, aud) the operator configured. Construct via
ExternalJwtIssuer::discover at engine boot; clone freely (the
JWKS sits behind an Arc<RwLock>).
Implementations§
Source§impl ExternalJwtIssuer
impl ExternalJwtIssuer
Sourcepub async fn discover(
issuer_url: String,
audience: Vec<String>,
refresh_secs: u64,
) -> Result<Self>
pub async fn discover( issuer_url: String, audience: Vec<String>, refresh_secs: u64, ) -> Result<Self>
Discover the issuer’s metadata (<issuer_url>/.well-known/openid-configuration),
fetch the initial JWKS, and return a verifier ready for use.
Spawns a background task that refreshes the JWKS every
refresh_secs seconds — handles upstream key rotation without
operator intervention.
Sourcepub fn issuer(&self) -> &str
pub fn issuer(&self) -> &str
iss claim this verifier accepts. Useful for matching incoming
tokens to the right verifier without calling Self::verify
(avoids signature work for tokens from other issuers).
Sourcepub fn verify<T: DeserializeOwned>(&self, token: &str) -> Result<TokenData<T>>
pub fn verify<T: DeserializeOwned>(&self, token: &str) -> Result<TokenData<T>>
Verify a JWT. The token’s iss must match this verifier’s
configured issuer; aud must overlap the configured audience
(or audience must be empty — operator opt-in to skip aud check).
Signature is verified against the cached JWKS, looked up by
kid from the JWT header.
Trait Implementations§
Source§impl Clone for ExternalJwtIssuer
impl Clone for ExternalJwtIssuer
Source§fn clone(&self) -> ExternalJwtIssuer
fn clone(&self) -> ExternalJwtIssuer
1.0.0 · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read moreAuto Trait Implementations§
impl Freeze for ExternalJwtIssuer
impl !RefUnwindSafe for ExternalJwtIssuer
impl Send for ExternalJwtIssuer
impl Sync for ExternalJwtIssuer
impl Unpin for ExternalJwtIssuer
impl UnsafeUnpin for ExternalJwtIssuer
impl !UnwindSafe for ExternalJwtIssuer
Blanket Implementations§
Source§impl<'a, T, E> AsTaggedExplicit<'a, E> for Twhere
T: 'a,
impl<'a, T, E> AsTaggedExplicit<'a, E> for Twhere
T: 'a,
Source§impl<'a, T, E> AsTaggedImplicit<'a, E> for Twhere
T: 'a,
impl<'a, T, E> AsTaggedImplicit<'a, E> for Twhere
T: 'a,
Source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
Source§impl<T> Instrument for T
impl<T> Instrument for T
Source§fn instrument(self, span: Span) -> Instrumented<Self>
fn instrument(self, span: Span) -> Instrumented<Self>
Source§fn in_current_span(self) -> Instrumented<Self>
fn in_current_span(self) -> Instrumented<Self>
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more