Struct AuthState 

pub struct AuthState {
    pub oidc_client: OidcClient,
    pub resource_server: ResourceServerClient,
    pub client_config: OidcClientConfig,
    pub config: AuthConfig,
    pub pkce_manager: PkceCookieManager,
    pub session_manager: Arc<WebSessionManager>,
    pub issuer_fallbacks: Vec<String>,
    pub cedar_authorizer: Option<Arc<CedarAuthorizer>>,
    pub identity_registry: IdentityRegistry,
    /* private fields */
}

Shared authentication state, stored in ServerState.

Fields

oidc_client: OidcClient

OIDC client for login flow (authorization code + PKCE)

resource_server: ResourceServerClient

Resource server client for JWT validation (lazy-initialized)

client_config: OidcClientConfig

OIDC client configuration

config: AuthConfig

Auth configuration

pkce_manager: PkceCookieManager

Stateless PKCE cookie manager

session_manager: Arc<WebSessionManager>

Web session manager (cookie session_id → server-side token with auto-refresh)

issuer_fallbacks: Vec<String>

16F: service-account issuer candidates (Kanidm vhosts agent tokens are minted on). Tokens carrying one of these fail primary validation (the [oidc] issuer is a different vhost) — check_auth falls back to validating against each candidate, never skipping issuer checks. Same IdP, same keys, no trust expansion.

cedar_authorizer: Option<Arc<CedarAuthorizer>>

Cedar authorizer for ABAC authorization (None = Cedar disabled)

identity_registry: IdentityRegistry

ec3e0622 root-cause fix: stable identity pins (sub → user_key), derived ONCE at first sighting and never recomputed from claims. Agents bypass it (their key is already the immutable sub).

Implementations

impl AuthState

pub fn new(config: AuthConfig) -> Self

Create new auth state from configuration.

pub fn with_cedar( config: AuthConfig, cedar_authorizer: Option<Arc<CedarAuthorizer>>, ) -> Self

Create new auth state with optional Cedar authorizer.

pub fn resolve_user_key(&self, claims: &JwtClaims) -> String

ec3e0622 root-cause fix: resolve the namespace key THROUGH the pin registry — the 16D derivation is consulted exactly ONCE per principal (first sighting) and then never again. Claims may gate PERMISSIONS (Cedar) but can no longer rotate the user’s home directory. Agents bypass the registry (their key is the immutable sub, per 16E).

pub fn with_issuer_fallbacks(self, issuers: Vec<String>) -> Self

16F: set the service-account issuer fallback candidates.

pub fn is_dev_mode(&self) -> bool

Check if development mode is enabled.

pub async fn validate_token(&self, token: &str) -> Result<JwtClaims>

Validate a JWT token using PEP’s ResourceServerClient.

pub async fn validate_token_flexible(&self, token: &str) -> Result<JwtClaims>

16F: primary validation, then the service issuer if that fails — cached per token (issue c41eb9d7).

Kanidm stamps tokens with the vhost they were minted on: human logins carry the [oidc] issuer, agent tokens exchanged via the service credential carry the service issuer. Each validates only against its own — this tries both, never skipping issuer validation.

Results are cached (SHA-256(token)[:16] → claims, valid min(exp-120s, now+300s), cap 1024) so polling clients stop paying a double validation + log line per request. AUTHN only: callers MUST still run Cedar authorization per request (check_auth does).

pub async fn validate_token_on( &self, issuer_url: &str, token: &str, ) -> Result<JwtClaims>

Validate against a SPECIFIC issuer — validation AND enrichment must both run on the vhost that issued the token.

impl AuthState

pub async fn exchange_agent_token( &self, issuer_url: &str, service_token: &str, ) -> Result<(String, u64), StatusCode>

16F: exchange an agent-user’s Kanidm service token for a short-lived access token carrying role=agent, usable as the impersonated Bearer on the inner dispatch. Same grant the MCP credentials use (verified RFC 8693 shape); enrichment in validate_token resolves the role.

issuer_url MUST be the service-account issuer: Kanidm binds token exchange to the client origin — the [oidc] auth issuer host serves logins but rejects exchange with invalid_request, while the [mcp.credentials.*] service issuer (see ServerState::service_issuer) accepts it (verified live 2026-08-30: same token, 200 vs 400).

Trait Implementations

impl Clone for AuthState

fn clone(&self) -> AuthState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.