Struct OidcConfig 

pub struct OidcConfig {
    pub issuer: String,
    pub audience: Option<String>,
    pub additional_audiences: Vec<String>,
    pub jwks_cache_ttl_secs: u64,
    pub allowed_algorithms: Vec<String>,
    pub clock_skew_secs: u64,
    pub jwks_uri: Option<String>,
    pub required: bool,
    pub scope_claim: String,
    pub require_jti: bool,
    pub me: Option<MeEndpointConfig>,
}

OIDC authentication configuration.

Configure this with your identity provider’s issuer URL. The validator will automatically discover JWKS endpoint.

SECURITY CRITICAL: You MUST configure the audience field to prevent token confusion attacks. See the audience field documentation for details.

Fields

issuer: String

Issuer URL (e.g., https://your-tenant.auth0.com/)

Must match the iss claim in tokens exactly. Should include trailing slash if provider expects it.

audience: Option<String>

Expected audience claim (REQUIRED for security).

SECURITY CRITICAL: This field is mandatory. Tokens must have this value in their aud claim. This prevents token confusion attacks where tokens intended for service A can be used for service B.

For Auth0, this is typically your API identifier (e.g., https://api.example.com). For other providers, use a unique identifier that represents your application.

Set at least one of:

• audience (primary audience)
• additional_audiences (secondary audiences)

additional_audiences: Vec<String>

Additional allowed audiences (optional).

Some tokens may have multiple audiences. Add extras here.

jwks_cache_ttl_secs: u64

JWKS cache TTL in seconds.

How long to cache the JWKS before refetching. This is the MAXIMUM stolen-key replay window once a key rotation has propagated upstream: after an IdP rotates keys, FraiseQL keeps accepting tokens signed by a cached-but-rotated-out key until the cached entry expires or is flushed. To close the window immediately on a known compromise, call OidcValidator::invalidate_jwks_cache (e.g. via POST /admin/v1/auth/refresh-jwks). Default: 300 (5 minutes) — short to bound the replay window.

allowed_algorithms: Vec<String>

Allowed token algorithms.

Default: RS256 (most common for OIDC providers)

clock_skew_secs: u64

Clock skew tolerance in seconds.

Allow this many seconds of clock difference when validating exp/nbf/iat claims. Default: 60 seconds

jwks_uri: Option<String>

Custom JWKS URI (optional).

If set, skip OIDC discovery and use this URI directly. Useful for providers that don’t support standard discovery.

required: bool

Require authentication for all requests.

If false, requests without tokens are allowed (anonymous access). Default: true

scope_claim: String

Scope claim name.

The claim containing user scopes/permissions. Default: “scope” (space-separated string) Some providers use “scp” or “permissions” (array)

require_jti: bool

Require the jti (JWT ID) claim on every validated token.

When true, tokens without a jti are rejected with a validation error. When false (default), a missing jti is accepted but the token cannot be replay-checked.

Set to true when you have a ReplayCache configured, so that every token is guaranteed to be uniquely identifiable.

me: Option<MeEndpointConfig>

Configuration for the GET /auth/me session-identity endpoint.

When present and enabled = true, mounts GET /auth/me behind OIDC authentication. The endpoint reflects a configurable subset of the current session’s JWT claims to the frontend.

Default: None (endpoint not mounted).

Implementations

impl OidcConfig

pub fn auth0(domain: &str, audience: &str) -> Self

Create config for Auth0.

Arguments

• domain - Your Auth0 domain (e.g., “your-tenant.auth0.com”)
• audience - Your API identifier

pub fn keycloak(base_url: &str, realm: &str, client_id: &str) -> Self

Create config for Keycloak.

Arguments

• base_url - Keycloak server URL (e.g., https://keycloak.example.com)
• realm - Realm name
• client_id - Client ID (used as audience)

pub fn okta(domain: &str, audience: &str) -> Self

Create config for Okta.

Arguments

• domain - Your Okta domain (e.g., “your-org.okta.com”)
• audience - Your API audience (often “api://default”)

pub fn cognito(region: &str, user_pool_id: &str, client_id: &str) -> Self

Create config for AWS Cognito.

Arguments

• region - AWS region (e.g., “us-east-1”)
• user_pool_id - Cognito User Pool ID
• client_id - App client ID (used as audience)

pub fn azure_ad(tenant_id: &str, client_id: &str) -> Self

Create config for Microsoft Entra ID (Azure AD).

Arguments

• tenant_id - Azure AD tenant ID
• client_id - Application (client) ID

pub fn google(client_id: &str) -> Self

Create config for Google Identity.

Arguments

• client_id - Google OAuth client ID

pub fn validate(&self) -> Result<(), SecurityError>

Validate the configuration.

Errors

Returns SecurityError::SecurityConfigError if:

• Issuer is empty
• Issuer does not use HTTPS (except localhost/127.0.0.1)
• Neither audience nor additional_audiences are configured
• No algorithms are allowed

Trait Implementations

impl Clone for OidcConfig

fn clone(&self) -> OidcConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OidcConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OidcConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OidcConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for OidcConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.