Struct UnsecuredJwsValidator 

pub struct UnsecuredJwsValidator {
    pub principal_claim_name: String,
    pub allowable_clock_skew_ms: i64,
    pub custom_claim_check: Option<JpQuery>,
    pub valid_token_type: Option<String>,
    pub fallback_user_name_claim: Option<String>,
    pub fallback_user_name_prefix: Option<String>,
    pub groups_claim: Option<JpQuery>,
    pub groups_claim_delimiter: Option<String>,
}

Validates an unsecured JWS bearer token (alg: none) and derives the connection principal. Mirrors Kafka’s OAuthBearerUnsecuredValidatorCallbackHandler.

Fields

principal_claim_name: String

Claim whose string value becomes the principal name. Default sub.

allowable_clock_skew_ms: i64

Tolerance, in milliseconds, applied to the exp / iat temporal checks to absorb clock drift between the client and broker.

custom_claim_check: Option<JpQuery>

Precompiled JsonPath expression evaluated against the token’s claim set. Token is rejected when the expression yields empty/null/false. Compile once at validator construction.

valid_token_type: Option<String>

When set, the JWT typ header field must equal this string. Ignored when unset.

fallback_user_name_claim: Option<String>

Alternate claim name to read the principal name from when principal_claim_name is absent or empty. Strimzi’s “service-account fallback” — sub typically holds a UUID, client_id is the readable name.

fallback_user_name_prefix: Option<String>

Prepended to the resolved principal name ONLY when the fallback claim fires. Strimzi convention: “service-account-”.

groups_claim: Option<JpQuery>

Precompiled JsonPath expression extracting group memberships from the token claims. Compile-once-at-startup.

groups_claim_delimiter: Option<String>

When groups_claim resolves to a string (not an array), split on this delimiter. Common: “,” or “ “.

Implementations

impl UnsecuredJwsValidator

pub fn validate( &self, token: &str, now_ms: i64, ) -> Result<AuthOutcome, AuthError>

Validate token against now_ms (Unix epoch milliseconds), returning the authenticated Principal on success.

Errors

AuthError::InvalidToken for any structural, signature, temporal, scope, or principal-claim failure. The caller maps this onto the RFC 7628 invalid_token server error status.

Trait Implementations

impl Clone for UnsecuredJwsValidator

fn clone(&self) -> UnsecuredJwsValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UnsecuredJwsValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for UnsecuredJwsValidator

fn default() -> Self

Returns the “default value” for a type.

impl PartialEq for UnsecuredJwsValidator

fn eq(&self, other: &UnsecuredJwsValidator) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for UnsecuredJwsValidator