Struct GenericOAuthConfig 

pub struct GenericOAuthConfig {

    pub client_id: String,
    pub client_secret: Option<String>,
    pub discovery_url: Option<String>,
    pub discovery_headers: HeaderMap,
    pub require_id_token_verification: bool,
    pub authorization_url: Option<String>,
    pub token_url: Option<String>,
    pub user_info_url: Option<String>,
    pub end_session_endpoint: Option<String>,
    pub post_logout_redirect_uri: Option<String>,
    pub disable_provider_logout: bool,
    pub token_endpoint_auth: Option<TokenEndpointAuth>,
    pub authentication: Option<TokenEndpointSecretAuthentication>,
    pub scopes: Vec<String>,
    pub redirect_uri: Option<String>,
    pub response_type: Option<String>,
    pub response_mode: Option<String>,
    pub prompt: Option<String>,
    pub pkce: bool,
    pub access_type: Option<String>,
    pub access_token_expires_in: Option<f64>,
    pub authorization_url_params: IndexMap<String, String>,
    pub token_url_params: HashMap<String, String>,
    pub authorization_headers: HeaderMap,
    pub refresh_token_params: Option<RefreshTokenParameters>,
    pub get_token: Option<Arc<dyn OAuthTokenHandler>>,
    pub get_user_info: Option<Arc<dyn GenericOAuthUserInfoHandler>>,
    pub map_profile_to_user: Option<Arc<dyn OAuthProfileMapper>>,
    pub account_subject: Option<Arc<dyn OAuthAccountSubject>>,
    pub disable_implicit_sign_up: bool,
    pub disable_sign_up: bool,
    pub override_user_info: bool,
    pub require_email_verification: bool,
    pub allow_idp_initiated: bool,
    pub disable_id_token_nonce_binding: bool,
}

Generic OAuth and OpenID Connect provider configuration.

Discovery resolves once when the auth instance is built. Set require_id_token_verification for providers whose identity comes from ID tokens.

Fields

client_id: String

OAuth client identifier.

client_secret: Option<String>

Client secret; omit for public clients or private-key JWT authentication.

discovery_url: Option<String>

OpenID configuration URL.

discovery_headers: HeaderMap

Headers included in the discovery request.

require_id_token_verification: bool

Require discovery to supply a usable issuer and JWKS URI.

authorization_url: Option<String>

Explicit authorization endpoint; overrides discovery.

token_url: Option<String>

Explicit token endpoint; overrides discovery.

user_info_url: Option<String>

Explicit userinfo endpoint; overrides discovery.

end_session_endpoint: Option<String>

Explicit RP-initiated logout endpoint; overrides discovery.

post_logout_redirect_uri: Option<String>

Default redirect after provider logout.

disable_provider_logout: bool

Complete only local logout even when the provider supports logout.

token_endpoint_auth: Option<TokenEndpointAuth>

Client authentication for code exchange and token refresh.

authentication: Option<TokenEndpointSecretAuthentication>

Upstream’s legacy secret authentication selection.

scopes: Vec<String>

Default scopes; OIDC discovery providers also request openid.

redirect_uri: Option<String>

Override the generated callback URI.

response_type: Option<String>

Authorization response type; defaults to code.

response_mode: Option<String>

Authorization response mode, such as query or form_post.

prompt: Option<String>

Provider authentication prompt.

pkce: bool

Send PKCE challenges and verifiers; defaults to true.

access_type: Option<String>

Authorization access type, such as offline.

access_token_expires_in: Option<f64>

Fallback access-token lifetime when the token response omits an expiry.

authorization_url_params: IndexMap<String, String>

Extra authorization parameters in insertion order; reserved fields are protected.

token_url_params: HashMap<String, String>

Extra code-exchange parameters that cannot replace standard grant fields.

authorization_headers: HeaderMap

Additional headers for authorization-code exchange.

refresh_token_params: Option<RefreshTokenParameters>

Extra token refresh parameters.

get_token: Option<Arc<dyn OAuthTokenHandler>>

Custom code exchange for providers with a nonstandard token endpoint.

get_user_info: Option<Arc<dyn GenericOAuthUserInfoHandler>>

Custom raw-profile lookup.

map_profile_to_user: Option<Arc<dyn OAuthProfileMapper>>

Map profile fields independently of account recognition.

account_subject: Option<Arc<dyn OAuthAccountSubject>>

Override the immutable subject resolver (sub for OIDC, id for OAuth).

disable_implicit_sign_up: bool

Require an explicit requestSignUp to create a new user.

disable_sign_up: bool

Reject creation of new users through this provider.

override_user_info: bool

Update existing local profile fields on sign-in.

require_email_verification: bool

Require the local user’s email to be verified before issuing a session.

allow_idp_initiated: bool

Restart callbacks without state using a fresh authorization request.

disable_id_token_nonce_binding: bool

Disable the default OIDC nonce binding for providers that cannot echo a nonce.

Implementations

impl GenericOAuthConfig

pub fn auth0( client_id: &str, client_secret: &str, domain: &str, ) -> AuthResult<Self>

Configure Auth0 discovery from a domain or URL and the default OIDC scopes.

pub fn keycloak(client_id: &str, client_secret: &str, issuer: &str) -> Self

Configure Keycloak discovery from the realm issuer and default OIDC scopes.

pub fn okta(client_id: &str, client_secret: &str, issuer: &str) -> Self

Configure Okta discovery from the issuer and default OIDC scopes.

impl GenericOAuthConfig

pub fn gumroad(client_id: &str, client_secret: &str) -> Self

Configure Gumroad with its view_profile scope and user profile endpoint.

pub fn hubspot(client_id: &str, client_secret: &str) -> Self

Configure HubSpot with its oauth scope and access-token profile lookup.

pub fn patreon(client_id: &str, client_secret: &str) -> Self

Configure Patreon with its identity[email] scope and identity fields.

pub fn slack(client_id: &str, client_secret: &str) -> Self

Configure Slack with its OpenID scopes and userinfo profile mapping.

pub fn yandex(client_id: &str, client_secret: &str) -> Self

Configure Yandex with its info, email, and avatar scopes.

impl GenericOAuthConfig

pub fn line(client_id: &str, client_secret: &str) -> Self

Configure LINE code login with profile claims from its ID-token verification endpoint. Register each channel with its own name through OAuthPlugin::add_generic_provider.

impl GenericOAuthConfig

pub fn microsoft_entra_id( client_id: &str, client_secret: &str, tenant_id: &str, ) -> AuthResult<Self>

Configure Microsoft Entra ID for one concrete tenant GUID with verified ID tokens.

Trait Implementations

impl Clone for GenericOAuthConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for GenericOAuthConfig

fn default() -> Self

Returns the “default value” for a type.