Struct DomainLinkageValidator 

pub struct DomainLinkageValidator<R, V = DefaultVerifier> { /* private fields */ }

Available on crate feature domain-linkage only.

Validates domain linkage credentials and DID configuration resources (DID Configuration Resource Verification): the subject is a DID equal to the issuer, iss and sub, the one origin is the requested origin, the credential has an expiration date, no id, no extra claims or header parameters, and its signature verifies under a key of the DID listed under assertionMethod.

A configuration is written by whoever controls the origin, and every entry validated resolves its issuer’s DID, so validate_configuration and validate_linkage validate at most max_credentials entries of one configuration.

Examples

use identity_kit::domain_linkage::DomainLinkageValidator;
use identity_kit::jose::DefaultVerifier;
use identity_kit::methods::DidKey;
use identity_kit::resolver::Resolver;

let resolver = Resolver::builder().with(DidKey::default()).build();
let validator = DomainLinkageValidator::new(resolver, DefaultVerifier);
assert!(!validator.credential_validator().has_status_check());

Implementations

impl<R, V> DomainLinkageValidator<R, V>

pub const DEFAULT_MAX_CREDENTIALS: usize = 32

The most entries of one configuration new validates: 32.

impl<R: KeyResolver, V: JwsVerifier> DomainLinkageValidator<R, V>

pub fn new(resolver: R, verifier: V) -> Self

A validator resolving keys with resolver and verifying signatures with verifier, validating at most DEFAULT_MAX_CREDENTIALS entries of a configuration.

pub fn from_credential_validator( credentials: JwtCredentialValidator<R, V>, ) -> Self

A validator over credentials, validating at most DEFAULT_MAX_CREDENTIALS entries of a configuration.

pub fn with_max_credentials(self, max_credentials: usize) -> Self

This validator validating at most max_credentials entries of a configuration.

pub fn max_credentials(&self) -> usize

The most entries of one configuration validate_configuration and validate_linkage validate.

pub fn credential_validator(&self) -> &JwtCredentialValidator<R, V>

The credential validator.

pub async fn validate_credential( &self, jwt: &Jwt, origin: &Url, options: &CredentialValidationOptions, ) -> Result<DecodedCredential, DomainLinkageError>

Validates jwt as a domain linkage credential for origin.

Errors

The first DomainLinkageError found: the format checks first, then the signature, issuer binding and validity period of JwtCredentialValidator::validate.

pub async fn validate_linkage( &self, configuration: &DomainLinkageConfiguration, did: &Did, origin: &Url, options: &CredentialValidationOptions, ) -> Result<DecodedCredential, DomainLinkageError>

Validates the credential of configuration linking did to origin: the first JWT entry issued by did that validates. Entries naming did past the first max_credentials are not validated.

Errors

DomainLinkageError::NoCredentialFor when no JWT entry names did as issuer, DomainLinkageError::NoValidCredential with the error of each such entry otherwise, DomainLinkageError::TooManyCredentials for those past the limit.

pub async fn validate_configuration( &self, configuration: &DomainLinkageConfiguration, origin: &Url, options: &CredentialValidationOptions, ) -> Result<DomainLinkageReport, DomainLinkageError>

Validates every JWT entry of configuration for origin: succeeds when at least one does, reporting the rest as errors. Entries past the first max_credentials are not validated and report DomainLinkageError::TooManyCredentials.

Errors

DomainLinkageError::InvalidContext, or DomainLinkageError::NoValidCredential with the error of every JWT entry.

Trait Implementations

impl<R: Debug, V: Debug> Debug for DomainLinkageValidator<R, V>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.