Struct ClientCertConfig 

pub struct ClientCertConfig {
    pub trusted_ca_ders: Vec<Vec<u8>>,
    pub subject_allowlist: Vec<String>,
    pub issuer_allowlist: Vec<String>,
    pub require_san: bool,
    pub token_lifetime_secs: u64,
}

Configuration for ClientCertAuthMethod.

Fields

trusted_ca_ders: Vec<Vec<u8>>

DER-encoded trusted CA certificates.

When non-empty, the presented certificate’s issuer DN is matched against the subjects of these CAs. This provides a meaningful policy guard when the list is kept to a small, curated set of CAs you actually trust.

Security note: this is an issuer DN equality check, not a full cryptographic path validation. For cryptographic assurance configure your TLS library’s trusted CA store, then use this list as a second policy filter.

subject_allowlist: Vec<String>

Subject DN substrings that are allowed. An empty list accepts any subject (given other checks pass). Matching is case-sensitive substring search on the full Distinguished Name string (e.g. "CN=alice" or just "alice").

issuer_allowlist: Vec<String>

Issuer DN substrings that are allowed. An empty list accepts any issuer.

require_san: bool

When true, the certificate must contain a Subject Alternative Name (SAN) extension. PIV and modern TLS certificates always carry one; older enterprise CAs sometimes do not.

token_lifetime_secs: u64

Lifetime of the session issued after successful authentication (seconds).

Implementations

impl ClientCertConfig

pub fn new() -> Self

Create a permissive configuration with a 1-hour session lifetime.

pub fn trust_ca(self, ca_der: Vec<u8>) -> Self

Builder: add a trusted CA (DER-encoded).

pub fn allow_subject(self, pattern: impl Into<String>) -> Self

Builder: allow only subjects whose DN contains pattern.

pub fn allow_issuer(self, pattern: impl Into<String>) -> Self

Builder: allow only issuers whose DN contains pattern.

pub fn with_require_san(self) -> Self

Builder: require a SAN extension.

Trait Implementations

impl Clone for ClientCertConfig

fn clone(&self) -> ClientCertConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ClientCertConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ClientCertConfig

fn default() -> Self

Returns the “default value” for a type.