Struct SignedJwsValidator 

pub struct SignedJwsValidator {
    pub principal_claim_name: String,
    pub allowable_clock_skew_ms: i64,
    pub valid_issuer: Option<String>,
    pub expected_audience: Option<String>,
    pub custom_claim_check: Option<JpQuery>,
    pub valid_token_type: Option<String>,
    pub fallback_user_name_claim: Option<String>,
    pub fallback_user_name_prefix: Option<String>,
    pub groups_claim: Option<JpQuery>,
    pub groups_claim_delimiter: Option<String>,
    pub expiry_ms: Option<i64>,
    /* private fields */
}

Validates a signed JWS bearer token (RS256 / ES256) against a JWKS key set fetched from the identity provider, then checks the standard JWT claims and derives the connection principal.

The key set lives behind a JwksHandle so the broker’s background refresher can rotate keys without restarting the broker or taking a lock; each validate reads the current set.

Fields

principal_claim_name: String

Claim whose string value becomes the principal name. Default sub.

allowable_clock_skew_ms: i64

Tolerance, in milliseconds, applied to exp / iat / nbf.

valid_issuer: Option<String>

When set, the token iss claim must equal this exactly.

expected_audience: Option<String>

When set, the token aud claim must contain this value.

custom_claim_check: Option<JpQuery>

Precompiled JsonPath custom_claim_check. See UnsecuredJwsValidator for semantics.

valid_token_type: Option<String>

JWT typ header check. Ignored when unset.

fallback_user_name_claim: Option<String>

Alternate principal claim. See UnsecuredJwsValidator.

fallback_user_name_prefix: Option<String>

Prepended to the principal name only on fallback.

groups_claim: Option<JpQuery>

Precompiled JsonPath extracting group memberships.

groups_claim_delimiter: Option<String>

Delimiter when groups_claim resolves to a string.

expiry_ms: Option<i64>

Hard cache-expiry threshold, in milliseconds. When set, the validator rejects tokens if the paired refresher has not had a successful fetch within this window (using JwksHandle::last_successful_fetch_ms). None = no expiry check. Fails closed on prolonged IdP outage so a rotated-out key can’t keep signing valid tokens indefinitely.

Implementations

impl SignedJwsValidator

pub fn new(keys: JwksHandle) -> Self

A validator backed by keys, with the same claim/skew defaults as the unsecured validator and no issuer / audience constraint.

pub fn key_handle(&self) -> JwksHandle

The shared key-set handle, so the broker can hand the same cell to its JWKS refresher task.

pub fn validate( &self, token: &str, now_ms: i64, ) -> Result<AuthOutcome, AuthError>

Validate a signed bearer token against now_ms (Unix epoch ms).

Errors

AuthError::InvalidToken for any structural, signature, temporal, issuer, audience, scope, or principal-claim failure.

Trait Implementations

impl Clone for SignedJwsValidator

fn clone(&self) -> SignedJwsValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignedJwsValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.