Struct JwtConfig 

pub struct JwtConfig {
    pub jwks: Option<String>,
    pub jwt_sig_validation: bool,
    pub jwt_status_validation: bool,
    pub signature_algorithms_supported: HashSet<Algorithm>,
    pub token_cache_max_ttl_secs: usize,
    pub token_cache_capacity: usize,
    pub token_cache_earliest_expiration_eviction: bool,
    pub trusted_issuer_loader: TrustedIssuerLoaderConfig,
    pub jwks_refresh_interval: Option<u64>,
    pub jwks_refresh_min_interval: u64,
    pub status_list_refresh_interval_max: u64,
}

The set of Bootstrap properties related to JWT validation.

Fields

jwks: Option<String>

A Json Web Key Store (JWKS) with public keys.

If this is used, Cedarling will no longer try to fetch JWK Stores from a trustede identity provider and stick to using the local JWKS.

jwt_sig_validation: bool

Check the signature for all the Json Web Tokens.

This Requires the iss claim to be present in all the tokens and and the scheme must be https.

This setting overrides the iss validation settings in the following:

• access_token_config
• id_token_config
• userinfo_token_config

jwt_status_validation: bool

Whether to check the status of the JWT.

On startup, the Cedarling will fetch and retreive the latest Status List JWT from the .well-known/openid-configuration via the status_list_endpoint claim and cache it.

See the IETF Draft for more info.

signature_algorithms_supported: HashSet<Algorithm>

Only tokens signed with algorithms in this list can be valid.

token_cache_max_ttl_secs: usize

Maximum TTL (in seconds) for cached tokens. Zero disables the token cache entirely.

Defaults to Self::DEFAULT_TOKEN_CACHE_MAX_TTL_SECS (5 seconds): small enough that revocation / status-list changes are picked up promptly while still serving repeated requests for the same token from cache. Keep this value short (seconds, not minutes) to bound cache growth and staleness.

token_cache_capacity: usize

Maximum number of tokens the cache can store.

token_cache_earliest_expiration_eviction: bool

Enables eviction policy based on the earliest expiration time.

When the cache reaches its capacity, the entry with the nearest expiration timestamp will be removed to make room for a new one.

trusted_issuer_loader: TrustedIssuerLoaderConfig

Configuration for loading trusted issuers.

jwks_refresh_interval: Option<u64>

Optional override for JWKS periodic refresh interval in seconds. Set to None to use the server-driven or fallback interval.

jwks_refresh_min_interval: u64

Minimum interval in seconds between on-demand JWKS re-fetches per issuer.

status_list_refresh_interval_max: u64

Upper bound on the Status List JWT refresh interval in seconds.

Caps how long Cedarling waits between Status List refreshes. When the Status List JWT carries a ttl claim (per the IETF oauth-status-list spec), the effective refresh interval is min(jwt_ttl, status_list_refresh_interval_max) so the issuer can always request a more frequent refresh, but never a less frequent one. When the JWT omits ttl, this value is used directly.

A value of 0 is treated as “use the default” so the cache cannot be left to go stale forever. Non-zero values below MIN_STATUS_LIST_REFRESH_SECS (5) are clamped to that minimum.

Implementations

impl JwtConfig

pub const DEFAULT_TOKEN_CACHE_CAPACITY: usize = 100

Default maximum number of tokens the token cache can store.

pub const DEFAULT_TOKEN_CACHE_MAX_TTL_SECS: usize = 5

Default maximum TTL (seconds) for cached tokens.

Chosen as a small value so that repeated requests for the same token are served from cache, while revocation / status-list changes are still picked up within a few seconds. Prevents unbounded cache growth for tokens without an exp claim.

pub const DEFAULT_JWKS_REFRESH_MIN_INTERVAL: u64 = 30

Default minimum interval (seconds) between on-demand JWKS re-fetches per issuer.

pub const DEFAULT_STATUS_LIST_REFRESH_INTERVAL_MAX_SECS: u64 = 300

Default upper bound for the Status List JWT refresh interval (in seconds), applied when the Status List JWT has no ttl claim and as a cap on JWT- provided values. Also used when the bootstrap property is set to 0.

pub fn new_without_validation() -> Self

Creates a new JwtConfig instance with validation turned off for all tokens.

Intended for tests and trusted-environment embedders. Production deployments should use JwtConfig::default (strict).

pub fn allow_all_algorithms(self) -> Self

Adds all supported algorithms to signature_algorithms_supported.

Trait Implementations

impl Clone for JwtConfig

fn clone(&self) -> JwtConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for JwtConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for JwtConfig

fn default() -> Self

Cedarling uses strict-by-default validation.

The returned value is identical to what is produced when parsing an empty bootstrap configuration (BootstrapConfigRaw::default() → JwtConfig). Signature and status validation are on. To opt out for testing or trusted environments, set the flags explicitly or use JwtConfig::new_without_validation.

impl<'de> Deserialize<'de> for JwtConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for JwtConfig

fn eq(&self, other: &JwtConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for JwtConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for JwtConfig