Struct AuthenticationRequirement 

pub struct AuthenticationRequirement {
    pub acr_values: Vec<Box<str>>,
    pub max_age: Option<Duration>,
}

Available on crate feature consent only.

What the client asked for about the USER’s authentication, from an authorization request.

RFC 9470 section 4 carries exactly two parameters, both defined by OpenID Connect Core section 3.1.2.1, and this crate implements only those two. Reading two of OpenID Connect’s parameters does not make this OpenID Connect: there is no id_token, no UserInfo endpoint and no claims model here, and all three are off this crate’s list on purpose.

Fields

acr_values: Vec<Box<str>>

Requested authentication context classes, in order of preference, from the space-delimited acr_values parameter. Empty means the client asked for none.

Satisfied when the host’s reported acr is ANY of these. OpenID Connect Core section 3.1.2.1 makes acr_values a voluntary, ordered preference rather than a demand, so honouring a later entry is legal; RFC 9470 section 4 is what turns it into a requirement here, because the whole point of the exchange is that a resource server has already refused the token the previous acr produced.

Bounded by MAX_ACR_VALUES when it comes off the wire: a parameter naming more classes than that is REFUSED rather than truncated. A requirement a host builds itself is its own data and is not bounded here, for the reason rar::AuthorizationDetails::from_elements gives: these bounds defend against an unauthenticated stranger, not against the deployment.

max_age: Option<Duration>

The RFC 9470 section 4 / OpenID Connect Core section 3.1.2.1 max_age: how old the user’s authentication may be. None means the client did not constrain it.

max_age=0 is a real and meaningful value, not an absent one: it means re-authenticate now. It is kept as Some(Duration::ZERO) for that reason, and any elapsed time at all fails it.

Implementations

impl AuthenticationRequirement

pub fn none() -> Self

No requirement at all: what an ordinary authorization request carries.

pub fn from_pairs<I, K, V>(pairs: I) -> Result<Self, ErrorResponse>

where I: IntoIterator<Item = (K, V)>, K: AsRef<str>, V: AsRef<str>,

Collect the two RFC 9470 section 4 parameters from already-decoded (name, value) query pairs, the same shape crate::authorization::AuthorizationRequest::from_pairs takes.

This is a CONVENIENCE over AuthenticationRequirement::from_request, for a host that holds query pairs and nothing else. It is not what this crate’s own endpoints use: they build the requirement from the RESOLVED request, because for an RFC 9126 pushed request or an RFC 9101 signed one the query is not where these parameters live, and reading it anyway both drops the ones that were sent and honours ones that were not.

A repeated parameter keeps the FIRST occurrence, matching from_pairs and for the same reason: RFC 6749 section 3.1 says a parameter MUST NOT appear more than once, and last-wins is the smuggling-friendly choice when two intermediaries disagree about which copy counts.

pub fn from_request( request: &AuthorizationRequest<'_>, ) -> Result<Self, ErrorResponse>

The requirement an already-resolved authorization request carries.

THE one source of these two parameters for every path into the authorization endpoint. A plain RFC 6749 request populated the fields from its query, an RFC 9126 pushed request from the record it stored at push time, and an RFC 9101 signed request from the claims inside the signature; each of the three is the only text that path is allowed to trust, and this reads whichever one it was handed.

pub fn is_empty(&self) -> bool

Whether this asks for nothing, in which case no check has to run at all.

pub fn satisfied_by( &self, authentication: Option<&Authentication>, now: SystemTime, ) -> Result<(), StepUpFailure>

Hold a host’s reported authentication to this requirement.

The ORDER of the two checks is deliberate: freshness first, then class. A user whose login is both too old and of the wrong class is told to log in again, which is the action that fixes either problem, and it avoids telling a client which acr a stale session had.

An absent report fails any non-empty requirement. “The host told us nothing” must never read as “there is nothing to check”: that reading is what makes an unwired host silently satisfy every step-up challenge it is ever sent.

Trait Implementations

impl Clone for AuthenticationRequirement

fn clone(&self) -> AuthenticationRequirement

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthenticationRequirement

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthenticationRequirement

fn default() -> AuthenticationRequirement

Returns the “default value” for a type.

impl Eq for AuthenticationRequirement

impl PartialEq for AuthenticationRequirement

fn eq(&self, other: &AuthenticationRequirement) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for AuthenticationRequirement