Struct MtlsValidator 

pub struct MtlsValidator { /* private fields */ }

mTLS validator that extracts identity from client certificates.

Implementations

impl MtlsValidator

pub fn new(config: MtlsConfig) -> Self

Create a new mTLS validator.

pub fn extract_identity_from_cn( &self, cn: &str, ) -> Result<CertificateIdentity, AuthError>

Extract identity from a certificate CN.

Security contract

The cn parameter MUST come from the TLS layer (e.g., parsed from the peer certificate by the TLS terminator). Passing user-controlled strings directly (e.g., from an HTTP header) bypasses all certificate verification and is a critical security violation.

When MtlsConfig::allowed_cns is set, only CN values present in the allowlist are accepted.

pub fn extract_identity_from_san_dns( &self, dns_name: &str, ) -> Result<CertificateIdentity, AuthError>

Extract identity from a SAN DNS name.

Security contract

The dns_name parameter MUST come from the TLS layer.

pub fn extract_identity_from_san_email( &self, email: &str, ) -> Result<CertificateIdentity, AuthError>

Extract identity from a SAN email.

Security contract

The email parameter MUST come from the TLS layer.

pub fn is_enabled(&self) -> bool

Check if mTLS is enabled.

Trait Implementations

impl Clone for MtlsValidator

fn clone(&self) -> MtlsValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MtlsValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.