Struct OidcFederationStrategy 

pub struct OidcFederationStrategy<P, S = NoStore> { /* private fields */ }

An AuthStrategy that federates a third-party OIDC JWT (Clerk, Supabase, Auth0, …) into a CipherStash CTS service token via POST /api/authorise.

Each call to get_token returns a cached CTS token until it expires. Because /api/authorise issues no CTS refresh token, renewal means re-federating: the strategy calls the OidcProvider again for a current third-party JWT and exchanges it for a fresh CTS token. Supply an OidcProvider that returns the live provider token each time (e.g. wrapping clerk.session.getToken()).

The strategy is bound to a workspace CRN at construction. The region is derived from the CRN — there is no separate region argument — so a caller can’t accidentally point the strategy at one region while the CRN says another, matching AccessKeyStrategy.

Every returned token is checked against the CRN’s workspace — the same post-auth verification AccessKeyStrategy performs — so a token CTS minted for a different workspace (or one loaded from a poisoned shared cache) is never handed back. Verification can fail in two ways:

• AuthError::WorkspaceMismatch — the JWT decoded cleanly but its workspace claim doesn’t match the CRN’s workspace ID.
• AuthError::InvalidToken — the JWT is malformed or missing the workspace claim entirely, so verification can’t run.

When constructed via OidcFederationStrategyBuilder::with_token_store, the strategy also persists tokens through an external TokenStore so short-lived instances (e.g. one per Edge Function request) can share a cache and skip re-federating on every cold start. The workspace check runs on cached and store-loaded tokens too, not just freshly federated ones.

Example

use stack_auth::{AuthError, OidcProviderFn, OidcFederationStrategy, SecretToken};
use cts_common::Crn;

let crn: Crn = "crn:ap-southeast-2.aws:ZVATKW3VHMFG27DY".parse().unwrap();
let provider = OidcProviderFn::new(|| async {
    // Real consumers call into a provider SDK / FFI to fetch a live JWT.
    Ok::<_, AuthError>(SecretToken::new("header.payload.signature".to_string()))
});
let strategy = OidcFederationStrategy::new(crn, provider).unwrap();

Implementations

impl<P: OidcProvider> OidcFederationStrategy<P>

pub fn new(workspace_crn: Crn, oidc_provider: P) -> Result<Self, AuthError>

Create a new OidcFederationStrategy for the given workspace CRN and OIDC provider.

The auth endpoint is resolved automatically via service discovery using the region encoded in the CRN; the workspace ID is used to verify every federated token belongs to the right workspace.

A CRN with a service_name component (e.g. crn:ap-southeast-2.aws:ZVATKW3VHMFG27DY:zerokms) is accepted; the service_name is ignored. Only the region and workspace ID are load-bearing for this strategy.

pub fn builder( workspace_crn: Crn, oidc_provider: P, ) -> OidcFederationStrategyBuilder<P>

Return a builder for configuring an OidcFederationStrategy before construction.

Trait Implementations

impl<P: OidcProvider, S: TokenStore> AuthStrategy for &OidcFederationStrategy<P, S>

async fn get_token(self) -> Result<ServiceToken, AuthError>

Retrieve a valid access token, refreshing or re-authenticating as needed.