Struct JwksResolver 

pub struct JwksResolver<C> { /* private fields */ }

Available on crate feature jwks only.

Resolves a KeyReference::Jwks through the JWT VC issuer metadata of the issuer (SD-JWT VC §3.5); every other reference is Unsupported.

For an issuer https://host[:port][/path] it fetches https://host[:port]/.well-known/jwt-vc-issuer[/path] (a trailing / of the path dropped), requires the metadata’s issuer to be the issuer, takes its jwks, or fetches its jwks_uri, and returns the one key whose kid is the reference’s. Issuer and jwks_uri must be https, and the issuer has no query, fragment or credentials. The key set of an issuer is cached for a time to live (DEFAULT_TTL unless set with with_ttl), so a rotated key is found once its entry expires.

The issuer comes from the token, so the client fetches whatever a token names: client must enforce the protections ReqwestClient (feature reqwest) does (HTTPS only, no redirects, no non-public addresses after name resolution, a body limit and a timeout), or resolution becomes a request forgery primitive. Resolving says nothing about whether the issuer is trusted; that stays the application’s policy.

Examples

use identity_kit::methods::web::{HttpClient, HttpError, HttpResponse};
use identity_kit::resolver::{JwksResolver, KeyReference, KeyResolver as _, KeyRole};
use url::Url;

/// Serves the metadata of `https://example.com/issuer`.
struct Served;

#[async_trait::async_trait]
impl HttpClient for Served {
    async fn get(&self, url: &Url) -> Result<HttpResponse, HttpError> {
        assert_eq!(url.as_str(), "https://example.com/.well-known/jwt-vc-issuer/issuer");
        Ok(HttpResponse::new(200, r#"{
          "issuer": "https://example.com/issuer",
          "jwks": { "keys": [{
            "kid": "key-1", "kty": "OKP", "crv": "Ed25519",
            "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"
          }]}
        }"#))
    }
}

let resolver = JwksResolver::new(Served);
let reference = KeyReference::Jwks {
    issuer: Url::parse("https://example.com/issuer")?,
    kid: "key-1".to_owned(),
};
let key = resolver.resolve_key(&reference, KeyRole::Issuer).await?;
assert_eq!(key.crv(), Some("Ed25519"));

Implementations

impl<C> JwksResolver<C>

pub const DEFAULT_TTL: Duration

How long new keeps an issuer’s key set: five minutes.

pub const DEFAULT_CAPACITY: usize = 256

How many issuers new keeps key sets of.

pub fn new(client: C) -> Self

A resolver fetching with client, keeping key sets for DEFAULT_TTL.

pub fn with_ttl(self, ttl: Duration) -> Self

This resolver keeping key sets for ttl; zero keeps none.

pub fn with_capacity(self, capacity: usize) -> Self

This resolver keeping the key sets of at most capacity issuers (at least one).

pub fn ttl(&self) -> Duration

How long a key set is kept.

pub fn client(&self) -> &C

The HTTP client.

Trait Implementations

impl<C> Debug for JwksResolver<C>

where C: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<C: HttpClient> KeyResolver for JwksResolver<C>

fn resolve_key<'life0, 'life1, 'async_trait>( &'life0 self, key: &'life1 KeyReference, __arg2: KeyRole, ) -> Pin<Box<dyn Future<Output = Result<Jwk, KeyResolutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

The public key key names, usable in role.