Struct IntrospectionValidator 

pub struct IntrospectionValidator {
    pub client: Arc<dyn IntrospectionClient>,
    pub principal_claim_name: String,
    pub custom_claim_check: Option<JpQuery>,
    pub call_userinfo: bool,
    pub allowable_clock_skew_ms: i64,
    pub expected_audience: Option<String>,
    pub fallback_user_name_claim: Option<String>,
    pub fallback_user_name_prefix: Option<String>,
    pub groups_claim: Option<JpQuery>,
    pub groups_claim_delimiter: Option<String>,
}

RFC 7662 opaque-token introspection validator. Calls the introspection endpoint per token (no caching — RFC 7662 §4 discourages caching without explicit lifetime info; SASL is once per connection so the cost is acceptable). Optionally calls OIDC userinfo after a successful introspection and merges the profile claims over the introspection claims.

Fields

client: Arc<dyn IntrospectionClient>

principal_claim_name: String

Claim whose string value becomes the principal name. Default sub for generic OAuth flows; commonly client_id for Keycloak client-credentials.

custom_claim_check: Option<JpQuery>

Precompiled JsonPath custom_claim_check. See UnsecuredJwsValidator for semantics. Introspection has no JWT header, so there is no valid_token_type field here.

call_userinfo: bool

true iff a userinfo_endpoint_uri is configured; the validator calls client.userinfo(token) after a successful introspection and merges the response over the introspection claims.

allowable_clock_skew_ms: i64

Clock-skew tolerance for exp/iat/nbf checks on introspection-response timestamps (when present).

expected_audience: Option<String>

When set, the introspection-response aud claim (RFC 7662 §2.2) must contain this value. Defaults to None (no audience restriction). Prevents a token minted for another resource server of the same IdP, which still introspects as active: true, from authenticating here.

fallback_user_name_claim: Option<String>

Alternate principal claim. See UnsecuredJwsValidator.

fallback_user_name_prefix: Option<String>

Prepended to the principal name only on fallback.

groups_claim: Option<JpQuery>

Precompiled JsonPath extracting group memberships, evaluated against the merged claims (introspection + optional userinfo).

groups_claim_delimiter: Option<String>

Delimiter when groups_claim resolves to a string.

Implementations

impl IntrospectionValidator

pub async fn validate( &self, token: &str, now_ms: i64, ) -> Result<AuthOutcome, AuthError>

Validate a bearer token via RFC 7662 introspection + optional userinfo enrichment.

Errors

• AuthError::IntrospectionTransport on HTTP transport / parse failures.
• AuthError::InvalidToken on active != true, missing exp, missing principal claim, scope mismatch, or temporal-claim failure. exp is required so the SASL handler can populate session_lifetime_ms for KIP-368 re-authentication.

Trait Implementations

impl Clone for IntrospectionValidator

fn clone(&self) -> IntrospectionValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IntrospectionValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.