Struct Authentication 

pub struct Authentication {
    pub auth_time: SystemTime,
    pub acr: Option<Box<str>>,
}

Available on crate feature consent only.

What the HOST says about how, and when, it authenticated the resource owner.

This is a REPORT, not a proof. See the module docs: this crate cannot authenticate anyone and has no way to check this against anything, so it records it and holds requests to it.

Fields

auth_time: SystemTime

When the user actually authenticated. OpenID Connect Core section 2 defines auth_time as the “time when the End-User authentication occurred”, and RFC 9470 section 6 is what makes it worth carrying: max_age is meaningless without an instant to measure from. It is reported through both of that section’s channels, the JWT claim of 6.1 and the introspection member of 6.2.

NOT “when this request arrived”. A host that conflates the two makes every request look freshly authenticated, which is the one mistake that turns this whole mechanism into decoration.

acr: Option<Box<str>>

The authentication context class the host says was satisfied: OpenID Connect Core section 2 acr. None means the host reported none, which can satisfy no acr_values request.

The VALUES are the host’s own vocabulary. This crate compares them as opaque strings and deliberately knows nothing about what any of them means: there is no registry it could check against, and a library that pretended to understand “phr” would be asserting something about a login flow it has never seen.

Box<str>, not String: written once at the moment the host reports it and never appended to. Same reasoning as crate::token::IssuedToken::jkt.

Implementations

impl Authentication

pub fn at(auth_time: SystemTime) -> Self

A report with no acr, for an authentication that happened at auth_time.

auth_time is WHEN THE USER ACTUALLY LOGGED IN, not when this request arrived, and this constructor is the place that distinction is lost or kept. Passing SystemTime::now() here on every request makes every login look seconds old, which satisfies every max_age a client can ask for and turns RFC 9470 step-up into decoration for that deployment. Nothing downstream can detect it: see the module docs on which half of this boundary is the host’s.

pub fn with_acr(self, acr: &str) -> Self

Name the authentication context class this login satisfied.

&str rather than impl Into<String>: a generic here monomorphizes once per argument type at every call site, and the value is going into a Box<str> either way.

pub fn age(&self, now: SystemTime) -> Option<Duration>

How old this authentication is at now, or None if it is stamped in the future.

A future auth_time is not an error here: clocks on separate machines disagree, and the one decision this feeds (AuthenticationRequirement::satisfied_by) reads None as “no elapsed time”, which is the reading that cannot lock a user out over a clock skew.

Trait Implementations

impl Clone for Authentication

fn clone(&self) -> Authentication

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Authentication

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Authentication

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Authentication

impl PartialEq for Authentication

fn eq(&self, other: &Authentication) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Authentication

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Authentication