Struct JwtManager 

pub struct JwtManager { /* private fields */ }

Common JWT token management for OAuth 2.0 and OpenID Connect operations.

JwtManager provides comprehensive JWT token creation, verification, and management capabilities specifically designed for OAuth 2.0 authorization servers and OpenID Connect providers. It supports both symmetric and asymmetric signing algorithms with security best practices.

Supported Algorithms

• HMAC: HS256, HS384, HS512 (symmetric)
• RSA: RS256, RS384, RS512 (asymmetric)
• ECDSA: ES256, ES384, ES512 (asymmetric)
• EdDSA: EdDSA (asymmetric, Ed25519)

Security Features

• Algorithm Validation: Prevents algorithm confusion attacks
• Time Validation: Automatic exp, nbf, and iat claim validation
• Audience Validation: Ensures tokens are used by intended recipients
• Issuer Validation: Verifies token origin
• Secure Defaults: Uses secure algorithm choices and expiration times

Token Types Supported

• Access Tokens: OAuth 2.0 access tokens with scopes
• ID Tokens: OpenID Connect identity tokens
• Refresh Tokens: Long-lived tokens for access token renewal
• Custom Tokens: Application-specific token types

Key Management

• Symmetric Keys: HMAC-based signing with shared secrets
• RSA Keys: Support for PKCS#1 and PKCS#8 key formats
• Key Rotation: Support for multiple signing keys
• Key Security: Secure key storage and access patterns

Example

use auth_framework::server::core::common_jwt::{JwtManager, JwtConfig, CommonJwtClaims};

// Create JWT manager with RSA keys
let config = JwtConfig::with_rsa_keys(
    private_key_bytes,
    public_key_bytes,
    "https://auth.example.com".to_string()
)?;
let jwt_manager = JwtManager::new(config);

// Create access token
let claims = CommonJwtClaims::new(
    "https://auth.example.com".to_string(),
    "user123".to_string(),
    vec!["api".to_string()],
    expiration_time
).with_custom_claim("scope".to_string(), json!("read write"));

let token = jwt_manager.create_token(&claims)?;

// Verify token
let verified_claims = jwt_manager.verify_token(&token)?;

Performance Considerations

• Asymmetric algorithms are more computationally expensive
• Token verification is optimized for high-throughput scenarios
• Key caching reduces cryptographic operation overhead

RFC Compliance

• RFC 7519: JSON Web Token (JWT)
• RFC 7515: JSON Web Signature (JWS)
• RFC 8725: JWT Best Current Practices
• RFC 9068: JWT Profile for OAuth 2.0 Access Tokens

Implementations

impl JwtManager

pub fn new(config: JwtConfig) -> Self

Create new JWT manager

pub fn create_token(&self, claims: &CommonJwtClaims) -> Result<String>

Create signed JWT token

pub fn create_token_with_custom_claims<T>(&self, claims: &T) -> Result<String>

where T: Serialize,

Create signed token with custom claims

pub fn verify_token(&self, token: &str) -> Result<CommonJwtClaims>

Verify and decode JWT token

pub fn verify_token_with_custom_claims<T>(&self, token: &str) -> Result<T>

where T: for<'de> Deserialize<'de>,

Verify token and extract custom claims

pub fn create_access_token( &self, subject: String, scope: Vec<String>, client_id: Option<String>, ) -> Result<String>

Create access token with standard claims

pub fn create_refresh_token( &self, subject: String, client_id: String, ) -> Result<String>

Create refresh token

pub fn create_id_token( &self, subject: String, nonce: Option<String>, auth_time: Option<i64>, user_info: HashMap<String, Value>, ) -> Result<String>

Create ID token for OpenID Connect