Struct AuthConfig 

pub struct AuthConfig {
    pub enabled: bool,
    pub validation_endpoint: Option<String>,
    pub trusted_issuers: Vec<String>,
    pub required_scopes: ScopeRequirements,
    pub cache_ttl_seconds: u64,
    pub validate_resource_indicators: bool,
    pub jwt_secret: Option<String>,
    pub require_signature_verification: bool,
}

Authentication configuration

Security Implications

Authentication is critical for preventing unauthorized access:

• Always enable in production - Disabling authentication exposes all operations
• Use strong JWT secrets - Weak secrets enable token forgery
• Validate resource indicators - Prevents token reuse across services
• Short cache TTLs - Reduces window for compromised tokens

Example: Secure Production Configuration

[auth]
enabled = true
validation_endpoint = "https://auth.example.com/validate"
trusted_issuers = ["https://auth.example.com"]
cache_ttl_seconds = 300  # 5 minutes
validate_resource_indicators = true
jwt_secret = "base64-encoded-256-bit-secret"
require_signature_verification = true

[auth.required_scopes]
default = ["kindlyguard:access"]

[auth.required_scopes.tools]
"security/scan" = ["security:read"]
"security/neutralize" = ["security:write", "security:admin"]

Fields

enabled: bool

Enable authentication (if false, all requests are allowed)

Default: false (for easier testing) Security: MUST be true in production. When false, anyone can access all operations without restriction. Warning: Running with authentication disabled is a critical security risk

validation_endpoint: Option<String>

Token validation endpoint (optional, for remote validation)

Default: None (local validation only) Security: Use HTTPS endpoints only. Remote validation adds latency but enables centralized token management and revocation. Example: “https://auth.example.com/oauth2/introspect”

trusted_issuers: Vec<String>

Trusted issuers

Default: empty (no issuers trusted) Security: Only tokens from these issuers will be accepted. Use specific issuer URLs, not wildcards or patterns. Example: [“https://auth.example.com”, “https://login.company.com”]

required_scopes: ScopeRequirements

Required scopes for different operations

Default: No specific requirements Security: Define granular scopes to implement least privilege. Prevents tokens with limited scopes from accessing sensitive operations.

cache_ttl_seconds: u64

Token cache settings

Default: 300 seconds (5 minutes) Security: Shorter TTLs reduce the window for compromised tokens but increase validation overhead. Balance security with performance. Range: 60-3600 seconds (recommend 300-900 for most cases)

validate_resource_indicators: bool

Enable resource indicators validation

Default: true (secure by default) Security: Validates that tokens are intended for this specific service. Prevents token reuse attacks across different services (RFC 8707). Warning: Disabling allows tokens meant for other services

jwt_secret: Option<String>

JWT signing secret (base64 encoded) for HMAC-SHA256 verification

Default: None Security: Use a cryptographically secure 256-bit (32 byte) secret. Must be kept confidential and rotated regularly. Generation: openssl rand -base64 32 Warning: Weak secrets enable token forgery attacks

require_signature_verification: bool

Require JWT signature verification

Default: false Security: When true, all tokens must have valid signatures. Essential for preventing token tampering and forgery. Dependencies: Requires jwt_secret to be configured

Trait Implementations

impl Clone for AuthConfig

fn clone(&self) -> AuthConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AuthConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AuthConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.