Struct OAuthProviderConfig 

pub struct OAuthProviderConfig {
    pub name: Arc<str>,
    pub scopes: Vec<String>,
    pub ceremony_timeout: Duration,
    /* private fields */
}

Available on crate feature oauth only.

Configuration for an OAuth 2.0 / OIDC identity provider.

Fields

name: Arc<str>

Short identifier for this provider (e.g. "google", "github").

scopes: Vec<String>

Scopes to request. Default: ["openid", "email", "profile"].

ceremony_timeout: Duration

How long the OAuth ceremony (redirect → callback) is valid. Default: 10 minutes. Set higher for IdPs with slow MFA prompts.

Implementations

impl OAuthProviderConfig

pub fn with_scopes(self, scopes: Vec<String>) -> OAuthProviderConfig

Override the default scopes.

pub fn with_ceremony_timeout(self, timeout: Duration) -> OAuthProviderConfig

Override the ceremony timeout (default: 10 minutes).

pub fn with_fapi( self, config: FapiConfig, ) -> Result<OAuthProviderConfig, OAuthError>

Enable FAPI 2.0 Baseline Profile for this provider.

Enforces: mandatory PAR, sender-constrained tokens (DPoP or MTLS), and stricter ID token lifetime validation. Requires the IdP to advertise a pushed_authorization_request_endpoint in discovery.

pub fn with_par_endpoint(self, url: impl Into<String>) -> OAuthProviderConfig

Manually set the PAR endpoint (RFC 9126).

Only needed if the IdP doesn’t advertise it in OIDC discovery metadata.

pub fn with_revocation_endpoint( self, url: impl Into<String>, ) -> OAuthProviderConfig

Manually set the OAuth 2.0 token revocation endpoint (RFC 7009).

Only needed when the IdP exposes a revocation endpoint but does not advertise it in the standard OIDC discovery metadata under the revocation_endpoint field; discover() then leaves revoke_token returning Config("...does not include a revocation_endpoint"). Use this setter to override.

pub fn with_end_session_endpoint( self, url: impl Into<String>, ) -> OAuthProviderConfig

Manually set the OIDC RP-Initiated Logout endpoint (end_session_endpoint).

Same rationale as with_revocation_endpoint: many IdPs expose the endpoint without advertising it in discovery, so build_end_session_url returns None until the URL is supplied.

pub fn with_allowed_post_logout_redirect_uris( self, uris: impl IntoIterator<Item = impl Into<String>>, ) -> OAuthProviderConfig

Configure the set of post_logout_redirect_uri values accepted by build_end_session_url. Each entry must match exactly (no glob / substring matching); values not in the list are silently dropped before being passed to the IdP, defeating phishing chains where an attacker tricks a user-controlled redirect parameter through the logout flow.

pub fn with_device_authorization_endpoint( self, url: impl Into<String>, ) -> OAuthProviderConfig

Set the device authorization endpoint URL (RFC 8628).

Required for the device code flow. Not part of standard OIDC discovery; check your IdP’s documentation for the URL.

pub fn with_clock(self, clock: Arc<dyn Clock>) -> OAuthProviderConfig

Swap the clock used for FAPI nbf / clock-skew checks. Defaults to SystemClock. Pass a MockClock under DST so the time-bound validation is deterministic.

impl OAuthProviderConfig

pub async fn discover( name: &str, issuer_url: &str, client_id: &str, client_secret: &str, redirect_url: &str, ) -> Result<OAuthProviderConfig, OAuthError>

Create a provider using OIDC discovery.

Fetches {issuer_url}/.well-known/openid-configuration to configure authorization, token, and userinfo endpoints automatically.

impl OAuthProviderConfig

pub async fn refresh_jwks(&self) -> Result<(), OAuthError>

Re-fetch the IdP’s JWKS via JwksCache::refresh.

Called automatically by the back-channel logout handler when a kid is not found in the cached JWKS (IdP key rotation). Can also be called proactively on a schedule.

Trait Implementations

impl OAuthProvider for OAuthProviderConfig

fn name(&self) -> &Arc<str>

Provider name (e.g. "google", "github").

fn issuer(&self) -> Option<&str>

OIDC issuer URL for this provider (e.g. "https://accounts.google.com").

fn client_id(&self) -> Option<&str>

OAuth client ID registered with this provider.

fn scopes(&self) -> &[String]

Scopes to request in the authorization URL.

fn ceremony_timeout(&self) -> Duration

Ceremony timeout for the OAuth redirect flow.

fn refresh_jwks<'a>( &'a self, ) -> Pin<Box<dyn Future<Output = Result<(), OAuthError>> + Send + 'a>>

Re-fetch the JWKS from the IdP’s jwks_uri.

fn verify_logout_jwt(&self, token: &str) -> Result<Value, OAuthError>

Verify the signature of a back-channel logout JWT using this provider’s JWKS keys.

fn fetch_userinfo<'a>( &'a self, access_token: &'a str, ) -> Pin<Box<dyn Future<Output = Result<UserInfoClaims, OAuthError>> + Send + 'a>>

Fetch additional user claims from the OIDC UserInfo endpoint.

fn refresh_token<'a>( &'a self, refresh_token: &'a str, ) -> Pin<Box<dyn Future<Output = Result<OAuthClaims, OAuthError>> + Send + 'a>>

Exchange a refresh token for new claims.

fn exchange_code<'a>( &'a self, code: &'a str, pkce_verifier: String, nonce: String, ) -> Pin<Box<dyn Future<Output = Result<OAuthClaims, OAuthError>> + Send + 'a>>

Exchange an authorization code for claims.

fn build_auth_url( &self, options: &OAuthLoginOptions, ) -> Result<(Url, String, String, String), OAuthError>

Build an authorization URL for the OAuth flow.

fn build_auth_url_par<'a>( &'a self, options: &'a OAuthLoginOptions, ) -> Pin<Box<dyn Future<Output = Result<(Url, String, String, String), OAuthError>> + Send + 'a>>

Build an authorization URL using Pushed Authorization Requests (RFC 9126).

fn fapi_config(&self) -> Option<&FapiConfig>

Return the FAPI configuration, if this provider has FAPI enabled.

fn push_authorization_request<'a>( &'a self, params: &'a [(&'a str, &'a str)], ) -> Pin<Box<dyn Future<Output = Result<ParResponse, OAuthError>> + Send + 'a>>

Push authorization parameters to the IdP’s PAR endpoint (RFC 9126).

fn generate_dpop_proof( &self, http_method: &str, http_url: &str, access_token: Option<&str>, key_seed: [u8; 32], ) -> Result<DpopProof, OAuthError>

Generate a DPoP proof JWT (RFC 9449) for the given HTTP method and URL.

fn build_end_session_url( &self, id_token_hint: Option<&str>, post_logout_redirect_uri: Option<&str>, state: Option<&str>, ) -> Option<Url>

Build the RP-Initiated Logout URL (OIDC RP-Initiated Logout 1.0).

fn revoke_token<'a>( &'a self, token: &'a str, token_type_hint: Option<&'a str>, ) -> Pin<Box<dyn Future<Output = Result<(), OAuthError>> + Send + 'a>>

Revoke an access or refresh token at the IdP (RFC 7009).

fn client_credentials<'a>( &'a self, scopes: &'a [&'a str], ) -> Pin<Box<dyn Future<Output = Result<ClientCredentialsToken, OAuthError>> + Send + 'a>>

Exchange client credentials for an access token (OAuth 2.0 Client Credentials grant, RFC 6749 section 4.4).

fn request_device_code<'a>( &'a self, scopes: &'a [&'a str], ) -> Pin<Box<dyn Future<Output = Result<DeviceAuthResponse, OAuthError>> + Send + 'a>>

Request a device code from the IdP’s device authorization endpoint.

fn poll_device_token<'a>( &'a self, device_code: &'a str, current_interval: u64, nonce: Option<&'a str>, ) -> Pin<Box<dyn Future<Output = Result<DeviceTokenOutcome, OAuthError>> + Send + 'a>>

Poll the token endpoint for a device code authorization result.