Struct openidconnect::IdTokenVerifier

pub struct IdTokenVerifier<'a, JS, JT, JU, K> where
    JS: JwsSigningAlgorithm<JT>,
    JT: JsonWebKeyType,
    JU: JsonWebKeyUse,
    K: JsonWebKey<JS, JT, JU>,  { /* fields omitted */ }

ID token verifier.

Implementations

impl<'a, JS, JT, JU, K> IdTokenVerifier<'a, JS, JT, JU, K> where
    JS: JwsSigningAlgorithm<JT>,
    JT: JsonWebKeyType,
    JU: JsonWebKeyUse,
    K: JsonWebKey<JS, JT, JU>, 

pub fn new_public_client(
    client_id: ClientId,
    issuer: IssuerUrl,
    signature_keys: JsonWebKeySet<JS, JT, JU, K>
) -> Self

Initializes a new verifier for a public client (i.e., one without a client secret).

pub fn new_confidential_client(
    client_id: ClientId,
    client_secret: ClientSecret,
    issuer: IssuerUrl,
    signature_keys: JsonWebKeySet<JS, JT, JU, K>
) -> Self

Initializes a new verifier for a confidential client (i.e., one with a client secret).

A confidential client verifier is required in order to verify ID tokens signed using a shared secret algorithm such as HS256, HS384, or HS512. For these algorithms, the client secret is the shared secret.

pub fn set_allowed_algs<I>(self, algs: I) -> Self where
    I: IntoIterator<Item = JS>, 

Specifies which JSON Web Signature algorithms are supported.

pub fn allow_any_alg(self) -> Self

Specifies that any signature algorithm is supported.

pub fn set_auth_context_verifier_fn<T>(self, acr_verifier_fn: T) -> Self where
    T: Fn(Option<&AuthenticationContextClass>) -> Result<(), String> + 'a + Send + Sync, 

Specifies a function for verifying the acr claim.

The function should return Ok(()) if the claim is valid, or a string describing the error otherwise.

pub fn set_auth_time_verifier_fn<T>(self, auth_time_verifier_fn: T) -> Self where
    T: Fn(Option<DateTime<Utc>>) -> Result<(), String> + 'a + Send + Sync, 

Specifies a function for verifying the auth_time claim.

The function should return Ok(()) if the claim is valid, or a string describing the error otherwise.

pub fn enable_signature_check(self) -> Self

Enables signature verification.

Signature verification is enabled by default, so this function is only useful if IdTokenVerifier::insecure_disable_signature_check was previously invoked.

pub fn insecure_disable_signature_check(self) -> Self

Disables signature verification.

Security Warning

Unverified ID tokens may be subject to forgery. See Section 16.3 for more information.

pub fn require_issuer_match(self, iss_required: bool) -> Self

Specifies whether the issuer claim must match the expected issuer URL for the provider.

pub fn require_audience_match(self, aud_required: bool) -> Self

Specifies whether the audience claim must match this client’s client ID.

pub fn set_time_fn<T>(self, time_fn: T) -> Self where
    T: Fn() -> DateTime<Utc> + 'a + Send + Sync, 

Specifies a function for returning the current time.

This function is used for verifying the ID token expiration time.

pub fn set_issue_time_verifier_fn<T>(self, iat_verifier_fn: T) -> Self where
    T: Fn(DateTime<Utc>) -> Result<(), String> + 'a + Send + Sync, 

Specifies a function for verifying the ID token issue time.

The function should return Ok(()) if the claim is valid, or a string describing the error otherwise.

pub fn set_other_audience_verifier_fn<T>(self, other_aud_verifier_fn: T) -> Self where
    T: Fn(&Audience) -> bool + 'a + Send + Sync, 

Specifies a function for verifying audiences included in the aud claim that differ from this client’s client ID.

The function should return true if the audience is trusted, or false otherwise.

Section 3.1.3.7 states that “The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.”

Trait Implementations

impl<'a, JS: Clone, JT: Clone, JU: Clone, K: Clone> Clone for IdTokenVerifier<'a, JS, JT, JU, K> where
    JS: JwsSigningAlgorithm<JT>,
    JT: JsonWebKeyType,
    JU: JsonWebKeyUse,
    K: JsonWebKey<JS, JT, JU>, 

fn clone(&self) -> IdTokenVerifier<'a, JS, JT, JU, K>

Returns a copy of the value.

pub fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.