axum_security_oidc/
lib.rs

1//! A minimal OpenID Connect client library, part of the
2//! [axum-security](https://crates.io/crates/axum-security) workspace and
3//! layered on [`axum-security-oauth2`](https://crates.io/crates/axum-security-oauth2)
4//! for the OAuth2 half of the flow.
5//!
6//! Compared to the [`openidconnect`](https://crates.io/crates/openidconnect)
7//! crate this one has no typestate and no type parameters: ID tokens are
8//! verified with a single concrete [`IdTokenVerifier`], and the standard claim
9//! set is a plain [`OidcClaims`] struct with `&str` fields plus an `extra` map
10//! for everything nonstandard.
11//!
12//! This first slice is the **verification core**: given a JWK set and an ID
13//! token, [`IdTokenVerifier::verify`] checks the signature (with algorithm
14//! allow-listing), the `iss`/`aud`/`exp`/`nbf` claims, and the `nonce`, using
15//! [`jsonwebtoken`] on top of `aws-lc-rs`. Discovery, JWKS fetching/caching, the
16//! login flow, and RP-initiated logout are layered on in later phases.
17//!
18//! # Example
19//!
20//! ```
21//! use axum_security_oidc::{IdTokenVerifier, JwkSet};
22//!
23//! # fn example(jwks_json: &str, id_token: &str, expected_nonce: &str)
24//! #     -> Result<(), Box<dyn std::error::Error>> {
25//! let jwks: JwkSet = serde_json::from_str(jwks_json)?;
26//! let verifier = IdTokenVerifier::new("https://issuer.example", "my-client-id", jwks);
27//!
28//! let verified = verifier.verify(id_token, expected_nonce)?;
29//! let claims = verified.claims()?;
30//! let _subject = claims.subject;
31//! # Ok(())
32//! # }
33//! ```
34//!
35//! # Features
36//!
37//! - `jiff` / `chrono` / `time` — add typed timestamp accessors to
38//!   [`OidcClaims`] / [`UtcTimestamp`]. Off by default; the core exposes raw
39//!   unix seconds (`i64`).
40
41mod builder;
42mod claims;
43mod client;
44mod error;
45mod jwks;
46mod logout;
47mod metadata;
48pub mod providers;
49mod verifier;
50
51pub use builder::{OidcBuilderError, OidcClientBuilder};
52pub use claims::{OidcAddress, OidcClaims, UtcTimestamp};
53pub use client::{OidcClient, OidcLogin, OidcTokens};
54pub use error::{ClaimsError, DiscoveryError, OidcError, VerifyError};
55pub use jwks::{DEFAULT_MIN_REFETCH_INTERVAL, JwksCache};
56pub use logout::LogoutUrl;
57pub use metadata::ProviderMetadata;
58pub use verifier::{IdTokenVerifier, VerifiedIdToken};
59
60/// Re-exported from [`jsonwebtoken`]: the signing-algorithm enum for
61/// [`IdTokenVerifier::algorithms`], and the JWK-set type
62/// [`IdTokenVerifier::new`] takes.
63pub use jsonwebtoken::{Algorithm, jwk::JwkSet};
64
65/// Re-exported from [`axum_security_oauth2`]: the shared HTTP backend used for
66/// discovery and JWKS fetches (clone the login flow's client in so both ride
67/// one connection pool), the [`CsrfToken`] carried by [`OidcLogin`], and the
68/// [`ConfigError`] wrapped by [`OidcBuilderError::OAuth2`].
69pub use axum_security_oauth2::{ConfigError, CsrfToken, HttpClient, HttpResponse};
axum_security_oidc/lib.rs

axum_security_oidc/
lib.rs
