Struct ValidationConfig

pub struct ValidationConfig { /* private fields */ }

Configures validation options for JWT issued by Google IAP.

Validation Options

• By default, validates the audience claim against the provided list.
• with_google_hosted_domain: Additionally validates the hd (hosted domain) claim.
• with_access_levels: Additionally validates the access levels claim in the Google-specific payload.

Implementations

impl ValidationConfig

pub fn new<A, I>(audience: I) -> Self

where A: Into<String>, I: IntoIterator<Item = A>,

Creates a new validation config with the given audience.

By default, validates the audience claim against the provided list.

pub fn with_google_hosted_domain<H, I>(self, google_hosted_domain: I) -> Self

where H: Into<String>, I: IntoIterator<Item = H>,

Validates that the hd claim is in the list of google hosted domains.

“If an account belongs to a hosted domain, the hd claim is provided to differentiate the domain the account is associated with.” - https://cloud.google.com/iap/docs/signed-headers-howto

pub fn with_access_levels<T: Into<String>>( self, access_levels: impl IntoIterator<Item = T>, ) -> Self

Validates that the access levels claim contains all the access levels in the config.

pub async fn decode_and_validate<E: Error + Send + 'static>( &self, token: &str, client: &impl PublicKeySource<Error = E>, ) -> Result<Claims, Error>

Decode and validate a jwt with respect to the IAP documentation: https://cloud.google.com/iap/docs/signed-headers-howto