Struct OidcConfig 

#[non_exhaustive]
pub struct OidcConfig { /* private fields */ }

OIDC client-credentials configuration for a token endpoint.

Construct with OidcConfig::new; #[non_exhaustive] so fields can be added without a breaking change.

Implementations

impl OidcConfig

pub fn new( token_url: impl Into<String>, client_id: impl Into<String>, client_secret: impl Into<String>, ) -> Self

Create a client-credentials configuration (no scope).

pub fn with_scope(self, scope: impl Into<String>) -> Self

Set the OAuth2 scope.

pub fn with_client_auth(self, client_auth: ClientAuth) -> Self

Choose how the client credentials are presented (ClientAuth).

The provider presets set this themselves; reach for it when pointing OidcConfig::new at an endpoint that wants the other form.

pub fn with_audience(self, audience: impl Into<String>) -> Self

Set the audience parameter of the token request — the API the token is being requested for.

Auth0 requires it (without one it issues an opaque token for its own userinfo endpoint, which a participant cannot verify). Most other providers ignore it.

pub fn client_auth(&self) -> ClientAuth

How the client credentials are presented to the token endpoint.

pub fn audience(&self) -> Option<&str>

The audience this configuration requests a token for, if any.

pub fn token_url(&self) -> &str

The OAuth2 token endpoint URL.

pub fn client_id(&self) -> &str

The OAuth2 client id.

pub fn keycloak( base_url: impl AsRef<str>, realm: impl AsRef<str>, client_id: impl Into<String>, client_secret: impl Into<String>, ) -> Self

Preset for Keycloak (also the Canton LocalNet IdP): builds the {base_url}/realms/{realm}/protocol/openid-connect/token endpoint.

pub fn auth0( domain: impl AsRef<str>, audience: impl Into<String>, client_id: impl Into<String>, client_secret: impl Into<String>, ) -> Self

Preset for Auth0: builds the https://{domain}/oauth/token endpoint and requests a token for audience.

The audience is the identifier of the Auth0 API the participant validates against — it cannot be derived from the domain, and Auth0 answers a client-credentials request without one by issuing a token for its own userinfo endpoint, which the participant will reject. Asking for it here is what makes this preset produce Auth0’s normal request.

pub fn okta( domain: impl AsRef<str>, auth_server: impl AsRef<str>, client_id: impl Into<String>, client_secret: impl Into<String>, ) -> Self

Preset for Okta: builds the https://{domain}/oauth2/{auth_server}/v1/token endpoint (use "default" for the default authorization server) and presents the credentials as HTTP Basic, which is Okta’s default for a confidential client.

An Okta app can be configured to accept them in the body instead; say so with .with_client_auth(ClientAuth::Post).

Trait Implementations

impl Clone for OidcConfig

fn clone(&self) -> OidcConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OidcConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.