Enum AssertionKeys 

pub enum AssertionKeys {
    ClientSecret {
        secret: ClientSecretKey,
    },
    PublicKeys {
        keys: Vec<PublicJwk>,
    },
}

Available on crate feature client-assertion only.

What a registration expects a client assertion to be signed with.

The variants are the two RFC 7523 methods, and the choice between them is the choice of algorithm: there is deliberately no way to spell “this client uses private_key_jwt and also HS256”. See verify_assertion.

Variants

ClientSecret

client_secret_jwt (RFC 7523 section 2.2 with a MAC): HMAC-SHA-256 under the registered client secret.

Weaker than AssertionKeys::PublicKeys and supported because deployments have it: the server still holds a secret that could authenticate as the client, so a dump of the client table is still a set of working credentials. What it does buy over client_secret_basic is that the secret never crosses the network, so it cannot be captured in transit or logged by an intermediary.

Fields

secret: ClientSecretKey

The shared secret. Held in the clear because HMAC verification needs the key itself; a one-way crate::client::SecretHash cannot be used here, and pretending otherwise would be the kind of storage that looks safe and is not.

A ClientSecretKey rather than a String so that the entropy floor cannot be walked past by writing the variant out by hand.

PublicKeys

private_key_jwt (RFC 7523 section 2.2 with a digital signature): ECDSA P-256 under a key only the client holds. This is the variant to reach for.

Fields

keys: Vec<PublicJwk>

The registered public keys. Several are allowed so a client can rotate: it publishes the new key alongside the old, signs with either during the overlap, and retires the old one when it is done. A server that accepted only one key would make rotation an outage.

Implementations

impl AssertionKeys

pub fn token_endpoint_auth_method(&self) -> &'static str

The RFC 8414 method name this registration authenticates with.

pub fn signing_alg(&self) -> &'static str

The ONE alg this registration’s assertions may carry.

Singular on purpose. A registration that accepted a SET of algorithms would be one where an attacker gets to pick from that set, and the interesting attacks are all about picking the element the deployment did not think about.

Trait Implementations

impl Clone for AssertionKeys

fn clone(&self) -> AssertionKeys

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AssertionKeys

Hand-written for the same reason as crate::client::ClientAuth’s: ClientAuth derives nothing that would print a secret, and this type sits inside it. The PUBLIC keys stay visible, because they are public and because “which keys does this registration actually hold” is the first question anyone debugging a private_key_jwt failure asks.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AssertionKeys

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for AssertionKeys

impl PartialEq for AssertionKeys

fn eq(&self, other: &AssertionKeys) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for AssertionKeys

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AssertionKeys