Struct azure_jwt::AzureJwtClaims

pub struct AzureJwtClaims {
    pub aud: String,
    pub azp: Option<String>,
    pub azpacr: Option<String>,
    pub iss: String,
    pub iat: u64,
    pub idp: Option<String>,
    pub nbf: u64,
    pub exp: u64,
    pub c_hash: Option<String>,
    pub at_hash: Option<String>,
    pub preferred_username: Option<String>,
    pub name: Option<String>,
    pub nonce: Option<String>,
    pub oid: String,
    pub roles: Option<Vec<String>>,
    pub scp: Option<String>,
    pub sub: String,
    pub tid: String,
    pub unique_name: Option<String>,
    pub ver: String,
}

Fields

aud: String

dentifies the intended recipient of the token. In id_tokens, the audience is your app's Application ID, assigned to your app in the Azure portal. Your app should validate this value, and reject the token if the value does not match.

azp: Option<String>

The application ID of the client using the token. The application can act as itself or on behalf of a user. The application ID typically represents an application object, but it can also represent a service principal object in Azure AD.

azpacr: Option<String>

Indicates how the client was authenticated. For a public client, the value is "0". If client ID and client secret are used, the value is "1". If a client certificate was used for authentication, the value is "2".

iss: String

Identifies the security token service (STS) that constructs and returns the token, and the Azure AD tenant in which the user was authenticated. If the token was issued by the v2.0 endpoint, the URI will end in /v2.0. The GUID that indicates that the user is a consumer user from a Microsoft account is 9188040d-6c67-4c5b-b112-36a304b66dad.

Your app should use the GUID portion of the claim to restrict the set of tenants that can sign in to the app, if applicable.

iat: u64

Unix timestamp. "Issued At" indicates when the authentication for this token occurred.

idp: Option<String>

Records the identity provider that authenticated the subject of the token. This value is identical to the value of the Issuer claim unless the user account not in the same tenant as the issuer - guests, for instance. If the claim isn't present, it means that the value of iss can be used instead. For personal accounts being used in an organizational context (for instance, a personal account invited to an Azure AD tenant), the idp claim may be 'live.com' or an STS URI containing the Microsoft account tenant 9188040d-6c67-4c5b-b112-36a304b66dad

nbf: u64

Unix timestamp. The "nbf" (not before) claim identifies the time before which the JWT MUST NOT be accepted for processing.

exp: u64

Unix timestamp. he "exp" (expiration time) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing. It's important to note that a resource may reject the token before this time as well - if, for example, a change in authentication is required or a token revocation has been detected.

c_hash: Option<String>

The code hash is included in ID tokens only when the ID token is issued with an OAuth 2.0 authorization code. It can be used to validate the authenticity of an authorization code. For details about performing this validation, see the OpenID Connect specification.

at_hash: Option<String>

The access token hash is included in ID tokens only when the ID token is issued with an OAuth 2.0 access token. It can be used to validate the authenticity of an access token. For details about performing this validation, see the OpenID Connect specification.

preferred_username: Option<String>

The email claim is present by default for guest accounts that have an email address. Your app can request the email claim for managed users (those from the same tenant as the resource) using the email optional claim. On the v2.0 endpoint, your app can also request the email OpenID Connect scope - you don't need to request both the optional claim and the scope to get the claim. The email claim only supports addressable mail from the user's profile information.

name: Option<String>

The name claim provides a human-readable value that identifies the subject of the token. The value isn't guaranteed to be unique, it is mutable, and it's designed to be used only for display purposes. The profile scope is required to receive this claim.

nonce: Option<String>

The nonce matches the parameter included in the original /authorize request to the IDP. If it does not match, your application should reject the token.

oid: String

Guid. The immutable identifier for an object in the Microsoft identity system, in this case, a user account. This ID uniquely identifies the user across applications - two different applications signing in the same user will receive the same value in the oid claim. The Microsoft Graph will return this ID as the id property for a given user account. Because the oid allows multiple apps to correlate users, the profile scope is required to receive this claim. Note that if a single user exists in multiple tenants, the user will contain a different object ID in each tenant - they're considered different accounts, even though the user logs into each account with the same credentials.

roles: Option<Vec<String>>

The set of roles that were assigned to the user who is logging in.

scp: Option<String>

The set of scopes exposed by your application for which the client application has requested (and received) consent. Your app should verify that these scopes are valid ones exposed by your app, and make authorization decisions based on the value of these scopes. Only included for user tokens.

sub: String

The principal about which the token asserts information, such as the user of an app. This value is immutable and cannot be reassigned or reused. The subject is a pairwise identifier - it is unique to a particular application ID. If a single user signs into two different apps using two different client IDs, those apps will receive two different values for the subject claim. This may or may not be wanted depending on your architecture and privacy requirements.

tid: String

A GUID that represents the Azure AD tenant that the user is from. For work and school accounts, the GUID is the immutable tenant ID of the organization that the user belongs to. For personal accounts, the value is 9188040d-6c67-4c5b-b112-36a304b66dad. The profile scope is required to receive this claim.

unique_name: Option<String>

Provides a human readable value that identifies the subject of the token. This value isn't guaranteed to be unique within a tenant and should be used only for display purposes. Only issued in v1.0 id_tokens.

ver: String

Indicates the version of the id_token. Either 1.0 or 2.0.

Trait Implementations

impl Debug for AzureJwtClaims

fn fmt(&self, f: &mut Formatter) -> Result

Formats the value using the given formatter.

impl Serialize for AzureJwtClaims

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error> where
    __S: Serializer, 

Serialize this value into the given Serde serializer.

impl<'de> Deserialize<'de> for AzureJwtClaims

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error> where
    __D: Deserializer<'de>, 

Deserialize this value from the given Serde deserializer.