Crate axum_security_oidc

Expand description

A minimal OpenID Connect client library, part of the axum-security workspace and layered on axum-security-oauth2 for the OAuth2 half of the flow.

Compared to the openidconnect crate this one has no typestate and no type parameters: ID tokens are verified with a single concrete IdTokenVerifier, and the standard claim set is a plain OidcClaims struct with &str fields plus an extra map for everything nonstandard.

This first slice is the verification core: given a JWK set and an ID token, IdTokenVerifier::verify checks the signature (with algorithm allow-listing), the iss/aud/exp/nbf claims, and the nonce, using jsonwebtoken on top of aws-lc-rs. Discovery, JWKS fetching/caching, the login flow, and RP-initiated logout are layered on in later phases.

§Example

use axum_security_oidc::{IdTokenVerifier, JwkSet};

let jwks: JwkSet = serde_json::from_str(jwks_json)?;
let verifier = IdTokenVerifier::new("https://issuer.example", "my-client-id", jwks);

let verified = verifier.verify(id_token, expected_nonce)?;
let claims = verified.claims()?;
let _subject = claims.subject;

§Features

jiff / chrono / time — add typed timestamp accessors to OidcClaims / UtcTimestamp. Off by default; the core exposes raw unix seconds (i64).

Modules§

providers: Issuer URLs for common OpenID Connect providers, used by the OidcClient discovery shortcuts.

Structs§

CsrfToken: Re-exported from axum_security_oauth2: the shared HTTP backend used for discovery and JWKS fetches (clone the login flow’s client in so both ride one connection pool), the CsrfToken carried by OidcLogin, and the ConfigError wrapped by OidcBuilderError::OAuth2. The CSRF token embedded in the authorization URL’s state parameter.
HttpResponse: Re-exported from axum_security_oauth2: the shared HTTP backend used for discovery and JWKS fetches (clone the login flow’s client in so both ride one connection pool), the CsrfToken carried by OidcLogin, and the ConfigError wrapped by OidcBuilderError::OAuth2. The response from HttpClient::get: the HTTP status and the raw body.
IdTokenVerifier: Verifies OpenID Connect ID tokens against a JWK set.
JwkSet: Re-exported from jsonwebtoken: the signing-algorithm enum for IdTokenVerifier::algorithms, and the JWK-set type IdTokenVerifier::new takes. A JWK set
JwksCache: A JWKS-backed ID-token verifier that fetches (and caches) the provider’s signing keys.
LogoutUrl: Builds an RP-Initiated Logout URL (OpenID Connect RP-Initiated Logout 1.0): the provider’s end_session_endpoint with the optional parameters appended as query string.
OidcAddress: The address claim from an OpenID Connect ID token.
OidcClaims: Claims from a verified OpenID Connect ID token.
OidcClient: An OpenID Connect client: the OAuth2 authorization-code login flow plus ID-token verification.
OidcClientBuilder: Builds an OidcClient. Created with OidcClient::builder, OidcClient::discover, or a provider shortcut.
OidcLogin: The first leg of an OpenID Connect login, created by OidcClient::start_login.
OidcTokens: The result of a successful login: the verified ID token plus the OAuth2 tokens. Created by OidcClient::finish_login.
ProviderMetadata: OpenID Connect provider metadata, from a .well-known/openid-configuration document (OpenID Connect Discovery 1.0 §3).
UtcTimestamp: A UTC timestamp represented as seconds since the Unix epoch.
VerifiedIdToken: A successfully verified ID token.

Enums§

Algorithm: Re-exported from jsonwebtoken: the signing-algorithm enum for IdTokenVerifier::algorithms, and the JWK-set type IdTokenVerifier::new takes. The algorithms supported for signing/verifying JWTs
ClaimsError: A failure while deserializing a verified ID token’s payload into OidcClaims.
ConfigError: Re-exported from axum_security_oauth2: the shared HTTP backend used for discovery and JWKS fetches (clone the login flow’s client in so both ride one connection pool), the CsrfToken carried by OidcLogin, and the ConfigError wrapped by OidcBuilderError::OAuth2. Errors from OAuth2ClientBuilder::try_build.
DiscoveryError: A failure while fetching OpenID Connect provider metadata from a .well-known/openid-configuration document.
HttpClient: Re-exported from axum_security_oauth2: the shared HTTP backend used for discovery and JWKS fetches (clone the login flow’s client in so both ride one connection pool), the CsrfToken carried by OidcLogin, and the ConfigError wrapped by OidcBuilderError::OAuth2. The HTTP backend used for token requests.
OidcBuilderError: Errors from OidcClientBuilder::try_build.
OidcError: A failure in the OpenID Connect login flow (OidcClient::finish_login).
VerifyError: A failure while verifying an ID token.

Constants§

DEFAULT_MIN_REFETCH_INTERVAL: Default minimum time between JWKS refetch attempts triggered by an unknown signing key; bounds the JWKS load a stream of bogus-kid tokens can cause.