Struct Claims 

pub struct Claims {

    pub sub: String,
    pub aud: String,
    pub iss: String,
    pub sid: String,
    pub exp: i64,
    pub iat: i64,
    pub email: Option<String>,
    pub email_verified: Option<bool>,
    pub amr: Vec<String>,
    pub sso_connection: Option<String>,
    pub auth_time: Option<i64>,
    pub roles: Vec<String>,
    pub acr: Option<String>,
}

The claims a verified access token carries.

Fields

sub: String

The user this token speaks for.

aud: String

The client the token was minted for; checked against ours.

iss: String

The issuing service.

sid: String

The session behind the token. A consuming app that needs instant revocation asks the auth service about this id; see the crate docs for why that is the exception rather than the rule.

exp: i64

iat: i64

email: Option<String>

email_verified: Option<bool>

amr: Vec<String>

Authentication methods used at login (RFC 8176).

sso_connection: Option<String>

The enterprise SSO connection this session was signed in through (issue #627), present only while that connection belongs to the client the token was minted for — which is this one, or the audience check above would already have refused the token.

None for every other way in, and for a token minted before the claim existed.

auth_time: Option<i64>

When the person last authenticated in a real ceremony, epoch seconds (issue #912). None only for a token minted before the claim existed, which Claims::authenticated_within treats as not fresh.

roles: Vec<String>

The account’s roles in the issuing instance (issue #912), present only for a client the instance registered to receive them. Empty otherwise.

acr: Option<String>

The authentication context (acr), urn:cratefield:stepup when the session spent a step-up transaction (issue #912). Absent otherwise.

Implementations

impl Claims

pub fn stepped_up_within(&self, max_age_secs: i64, now: i64) -> bool

Whether the person proved who they are with a passkey or an email link within the last max_age_secs seconds, measured from now (issue #912). This is the check a payment, signature or other irreversible approval gates on: a password, a federated sign-in or an old login does not pass it, however recent. false when the token has no auth_time.

pub fn authenticated_within(&self, max_age_secs: i64, now: i64) -> bool

Whether the person authenticated within the last max_age_secs seconds, measured from now (epoch seconds, taken from the caller’s clock). false when the token has no auth_time.

A relying party that is about to approve something checks this itself. Verification establishes who signed the token, not how recently the person proved who they are.

pub fn signed_in_via_sso(&self, connection_id: &str) -> bool

Whether this token came through one specific enterprise SSO connection, as opposed to any other way in.

Both halves are required. A token that named the connection without sso in amr would be one from before the claim existed, or one minted by something that did not go through the SSO flow, and a caller that gates on enterprise membership should refuse both.

Trait Implementations

impl Clone for Claims

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Claims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Claims

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Claims

impl PartialEq for Claims

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Claims