Enum Issuer 

pub enum Issuer {
    Cli,
    JwtSvid,
    Mtls,
    OAuth,
    Custom(String),
}

How a principal’s identity was vouched for at resolution time.

The SPIRE variant lands when a concrete adopter use case arrives; it is deliberately not yet present so the enum doesn’t carry a constructor that no resolver impl ever produces.

Variants

Cli

Identity supplied via CLI args or environment variables. Trust comes from the operator who started the process.

JwtSvid

Identity verified from a SPIFFE JWT-SVID. Trust comes from the SPIFFE-aware IdP whose JWKS signed the token; the resolver pinned the trust domain at construction.

Mtls

Identity verified from a SPIFFE X509-SVID presented over mTLS. Trust comes from the rustls peer-cert chain validation already performed by the TLS terminator; the resolver pinned the trust domain at construction and extracts the SPIFFE-ID from the leaf certificate’s SAN URI field.

OAuth

Identity verified from a bearer JWT via the generic WorkloadResolver. The adopter-supplied claim-mapping closure decides how the verified JWT claims map onto the SPIFFE-shape WorkloadId + tenant slug. Covers Kubernetes service accounts, GitHub Actions OIDC, GitLab CI OIDC, Okta, Azure AD, Auth0, axess’s LocalIdP, and any other JWT-issuing IdP; adopters write a small claim parser + mapper per issuer they care about.

Custom(String)

Adopter-labelled issuer for cases where the generic OAuth variant’s wire-string ("oauth") is not specific enough for audit logs or Cedar policies. Construct via Issuer::custom which validates the label format ([a-z0-9_]{1,32}).

Implementations

impl Issuer

pub fn custom(label: impl AsRef<str>) -> Result<Issuer, IdentityError>

Build an Issuer::Custom with a validated label.

Labels must match [a-z0-9_]{1,32} so that wire-strings (audit events, Cedar attribute values, SIEM grep patterns) stay short, stable, and grep-safe across issuers. Pre-defined examples: "github_actions", "kubernetes", "gitlab_ci", "circleci", "buildkite", "local_idp".

pub fn as_str(&self) -> &str

Stable lowercase wire-string for this variant. Use as the Cedar attribute value and any other on-wire serialization.

Trait Implementations

impl Clone for Issuer

fn clone(&self) -> Issuer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Issuer

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Issuer

fn deserialize<__D>( __deserializer: __D, ) -> Result<Issuer, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for Issuer

fn eq(&self, other: &Issuer) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Issuer

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for Issuer

impl StructuralPartialEq for Issuer