Struct OidcValidator 

pub struct OidcValidator { /* private fields */ }

OIDC token validator with JWKS caching.

Validates JWT tokens against an OIDC provider’s public keys. Automatically fetches and caches the JWKS for efficiency.

Implementations

impl OidcValidator

pub async fn new(config: OidcConfig) -> Result<Self>

Create a new OIDC validator.

This will perform OIDC discovery to find the JWKS URI unless jwks_uri is explicitly set in config.

Errors

Returns error if:

• Config validation fails
• OIDC discovery fails
• JWKS endpoint cannot be determined

pub fn with_jwks_uri(config: OidcConfig, jwks_uri: String) -> Self

Create a validator without performing discovery.

Use this for testing or when you have the JWKS URI directly.

pub async fn validate_token(&self, token: &str) -> Result<AuthenticatedUser>

Validate a JWT token and extract user information.

Arguments

• token - The JWT token string (without “Bearer “ prefix)

Returns

AuthenticatedUser if token is valid, error otherwise.

Errors

Returns error if:

• Token is malformed
• Signature verification fails
• Required claims are missing
• Token is expired
• Issuer/audience don’t match

pub fn is_required(&self) -> bool

Check if authentication is required.

pub fn issuer(&self) -> &str

Get the configured issuer.

pub fn clear_cache(&self)

Clear the JWKS cache.

Call this if you need to force a refresh of the signing keys.