Struct OidcConfig 

pub struct OidcConfig {
    pub issuer: String,
    pub audience: Option<String>,
    pub additional_audiences: Vec<String>,
    pub jwks_cache_ttl_secs: u64,
    pub allowed_algorithms: Vec<String>,
    pub clock_skew_secs: u64,
    pub jwks_uri: Option<String>,
    pub required: bool,
    pub scope_claim: String,
}

OIDC authentication configuration.

Configure this with your identity provider’s issuer URL. The validator will automatically discover JWKS endpoint.

SECURITY CRITICAL: You MUST configure the audience field to prevent token confusion attacks. See the audience field documentation for details.

Fields

issuer: String

Issuer URL (e.g., https://your-tenant.auth0.com/)

Must match the iss claim in tokens exactly. Should include trailing slash if provider expects it.

audience: Option<String>

Expected audience claim (REQUIRED for security).

SECURITY CRITICAL: This field is mandatory. Tokens must have this value in their aud claim. This prevents token confusion attacks where tokens from one service can be used in another.

For Auth0, this is typically your API identifier (e.g., https://api.example.com). For other providers, use a unique identifier that represents your application.

Set at least one of:

• audience (primary audience)
• additional_audiences (secondary audiences)

additional_audiences: Vec<String>

Additional allowed audiences (optional).

Some tokens may have multiple audiences. Add extras here.

jwks_cache_ttl_secs: u64

JWKS cache TTL in seconds.

How long to cache the JWKS before refetching. Default: 3600 (1 hour)

allowed_algorithms: Vec<String>

Allowed token algorithms.

Default: RS256 (most common for OIDC providers)

clock_skew_secs: u64

Clock skew tolerance in seconds.

Allow this many seconds of clock difference when validating exp/nbf/iat claims. Default: 60 seconds

jwks_uri: Option<String>

Custom JWKS URI (optional).

If set, skip OIDC discovery and use this URI directly. Useful for providers that don’t support standard discovery.

required: bool

Require authentication for all requests.

If false, requests without tokens are allowed (anonymous access). Default: true

scope_claim: String

Scope claim name.

The claim containing user scopes/permissions. Default: “scope” (space-separated string) Some providers use “scp” or “permissions” (array)

Implementations

impl OidcConfig

pub fn auth0(domain: &str, audience: &str) -> Self

Create config for Auth0.

Arguments

• domain - Your Auth0 domain (e.g., “your-tenant.auth0.com”)
• audience - Your API identifier

pub fn keycloak(base_url: &str, realm: &str, client_id: &str) -> Self

Create config for Keycloak.

Arguments

• base_url - Keycloak server URL (e.g., https://keycloak.example.com)
• realm - Realm name
• client_id - Client ID (used as audience)

pub fn okta(domain: &str, audience: &str) -> Self

Create config for Okta.

Arguments

• domain - Your Okta domain (e.g., “your-org.okta.com”)
• audience - Your API audience (often “api://default”)

pub fn cognito(region: &str, user_pool_id: &str, client_id: &str) -> Self

Create config for AWS Cognito.

Arguments

• region - AWS region (e.g., “us-east-1”)
• user_pool_id - Cognito User Pool ID
• client_id - App client ID (used as audience)

pub fn azure_ad(tenant_id: &str, client_id: &str) -> Self

Create config for Microsoft Entra ID (Azure AD).

Arguments

• tenant_id - Azure AD tenant ID
• client_id - Application (client) ID

pub fn google(client_id: &str) -> Self

Create config for Google Identity.

Arguments

• client_id - Google OAuth client ID

pub fn validate(&self) -> Result<()>

Validate the configuration.

Trait Implementations

impl Clone for OidcConfig

fn clone(&self) -> OidcConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OidcConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OidcConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OidcConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for OidcConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.