Expand description
Sign-in through an OpenID Connect provider.
slave apps do not handle passwords or mint their own tokens. Users sign in
with an OIDC provider (Google, Microsoft Entra, Auth0, Okta, Zitadel,
Keycloak, Authentik, Logto, …); clients send the provider’s ID token as
Authorization: Bearer <id_token>, and OidcVerifier checks it:
signature (the provider’s JWKS), issuer, audience (one of your client IDs)
and expiry.
Configure it with OIDC_ISSUER_URL and OIDC_AUDIENCES (the client IDs of
your apps, comma-separated).
Structs§
- Identity
- Who signed in, from a verified ID token.
- Oidc
Client - The sign-in side for apps that render pages on a server (e.g. an Axum theme): the Authorization Code flow with PKCE and a nonce.
- Oidc
Config - Which provider to trust, and for which client IDs.
- Oidc
Verifier - Verifies ID tokens from one provider. Cheap to clone.
- Pending
Sign In - What a sign-in in progress must remember between the redirect to the provider and the redirect back. Store it where only this browser can read it (an HttpOnly cookie); it is useless once the sign-in completes.
Enums§
- Verify
Error - Why a token was not accepted.
Constants§
- AUDIENCES_
ENV - Environment variable holding the accepted client IDs (comma-separated).
- ISSUER_
ENV - Environment variable holding the provider’s issuer URL.
- SETUP_
HINT - How to configure sign-in, shown when settings are missing.