Crate confium_oidc 

confium-oidc — OIDC token verifier for Mode 4 (Keyless Threshold).

Verifies OIDC tokens from any standards-compliant issuer (GitHub Actions, Google, Okta, Azure AD, Auth0, etc.) and extracts the identity claims the Fulcio-style CA needs to bind to the joint ephemeral threshold key.

Quickstart

use confium_oidc::{OidcVerifier, OidcIssuer};

let verifier = OidcVerifier::new();
let issuer = OidcIssuer::GitHubActions;
let claims = verifier.verify(&issuer, "eyJhbGciOi...")
    .expect("OIDC token verifies");
println!("{} ({})", claims.subject, claims.email.unwrap_or_default());

What this enables

Combined with confium-tc-cmp20 + a Fulcio-style CA, this crate powers keyless threshold signing ceremonies where each signer authenticates via OIDC and the joint ephemeral key is bound to the OIDC identities. See docs/architecture/mode-4-keyless-threshold.mdx for the full design.

Structs

GithubClaims

GitHub Actions-specific OIDC claims.

OidcClaims

Claims extracted from a verified OIDC token. The fields are the minimum the Fulcio-style CA needs to bind to the joint ephemeral threshold key.

OidcVerifier

OIDC token verifier. Cheap to construct; caches JWKS keys per issuer in memory.

Enums

OidcError

Errors returned by the verifier.

OidcIssuer

Known OIDC issuer. Each entry maps to a JWKS URL and a signature algorithm. The defaults cover the issuers Confium has been tested against; users can add their own via [OidcVerifier::with_issuer].