Struct OidcClient 

pub struct OidcClient { /* private fields */ }

A single discovered upstream — wraps the openidconnect typed client and the PoD metadata used to construct it.

The CoreClient generic state after from_provider_metadata + set_redirect_uri is <EndpointSet, EndpointNotSet, EndpointNotSet, EndpointNotSet, EndpointMaybeSet, EndpointMaybeSet> — auth URL set (so authorize_url works), token + userinfo MaybeSet (we error at runtime if the upstream’s discovery doc is missing one).

Implementations

impl OidcClient

pub fn provider(&self) -> &UpstreamProvider

Borrow the original PoD record.

pub fn redirect_uri(&self) -> &RedirectUrl

Borrow the configured redirect URI.

pub fn start_login(&self, state: CsrfToken) -> StartedLogin

Step 1 of the authorization-code-+-PKCE flow. Generates a PKCE pair, asks the openidconnect client for the redirect URL, returns the URL alongside the verifier + nonce for round-trip (callers persist them, typically in the session).

state lets callers pin a known CSRF value (e.g. the session id) rather than the library-generated random one — useful when the callback handler uses state to look the in-progress login up. Pass CsrfToken::new_random via CsrfToken::new(...) if you don’t have one already.

pub async fn complete_login( &self, code: String, pkce_verifier: PkceCodeVerifier, nonce: Nonce, ) -> Result<UpstreamUserInfo>

Step 2 — exchange the upstream’s code for tokens, validate the id_token against the cached JWKS + nonce, and (when the upstream publishes a userinfo endpoint) supplement the claims with a userinfo call.

pkce_verifier and nonce must be the values returned from OidcClient::start_login for the same login — callers persist them server-side keyed by state.