Struct OidcFederationStrategy 

pub struct OidcFederationStrategy<P, S = NoStore> { /* private fields */ }

An AuthStrategy that federates a third-party OIDC JWT (Clerk, Supabase, Auth0, …) into a CipherStash CTS service token via POST /api/authorise.

Each call to get_token returns a cached CTS token until it expires. Because /api/authorise issues no CTS refresh token, renewal means re-federating: the strategy calls the OidcProvider again for a current third-party JWT and exchanges it for a fresh CTS token. Supply an OidcProvider that returns the live provider token each time (e.g. wrapping clerk.session.getToken()).

Every returned token is checked against the configured workspace — the same post-auth verification AccessKeyStrategy performs — so a token CTS minted for a different workspace (or one loaded from a poisoned shared cache) is never handed back. Verification can fail in two ways:

• AuthError::WorkspaceMismatch — the JWT decoded cleanly but its workspace claim doesn’t match the configured workspace ID.
• AuthError::InvalidToken — the JWT is malformed or missing the workspace claim entirely, so verification can’t run.

When constructed via OidcFederationStrategyBuilder::with_token_store, the strategy also persists tokens through an external TokenStore so short-lived instances (e.g. one per Edge Function request) can share a cache and skip re-federating on every cold start. The workspace check runs on cached and store-loaded tokens too, not just freshly federated ones.

Example

use stack_auth::{AuthError, OidcProviderFn, OidcFederationStrategy, SecretToken};
use cts_common::{Region, WorkspaceId};

let region = Region::aws("ap-southeast-2").unwrap();
let workspace_id: WorkspaceId = "ZVATKW3VHMFG27DY".parse().unwrap();
let provider = OidcProviderFn::new(|| async {
    // Real consumers call into a provider SDK / FFI to fetch a live JWT.
    Ok::<_, AuthError>(SecretToken::new("header.payload.signature".to_string()))
});
let strategy = OidcFederationStrategy::new(region, workspace_id, provider).unwrap();

Implementations

impl<P: OidcProvider> OidcFederationStrategy<P>

pub fn new( region: Region, workspace_id: WorkspaceId, oidc_provider: P, ) -> Result<Self, AuthError>

Create a new OidcFederationStrategy for the given region, workspace, and OIDC provider.

The auth endpoint is resolved automatically via service discovery.

pub fn builder( region: Region, workspace_id: WorkspaceId, oidc_provider: P, ) -> OidcFederationStrategyBuilder<P>

Return a builder for configuring an OidcFederationStrategy before construction.

Trait Implementations

impl<P: OidcProvider, S: TokenStore> AuthStrategy for &OidcFederationStrategy<P, S>

async fn get_token(self) -> Result<ServiceToken, AuthError>

Retrieve a valid access token, refreshing or re-authenticating as needed.