Struct Confirmation 

#[non_exhaustive]
pub struct Confirmation {
    pub jkt: Option<String>,
    pub x5t_s256: Option<CertificateThumbprint>,
}

Available on crate features dpop or mtls only.

The RFC 7800 section 3.1 confirmation claim: HOW a token is sender constrained, meaning what a presenter has to prove in addition to holding the string.

This is what a resource server checks the binding against, and it is the whole reason sender constraining is worth anything at introspection time: without it the binding is known only to the authorization server, and an RS that introspects is back to trusting a bearer string.

EVERY MEMBER IS OPTIONAL, and that is the design rather than an accident. RFC 7800 section 3.1 defines cnf as a JSON OBJECT whose members are confirmation methods, and different sender-constraining mechanisms register different members OF THE SAME OBJECT: RFC 9449 section 6.1 registers jkt for a DPoP key binding, RFC 8705 section 3.1 registers x5t#S256 for a certificate binding. A token can legitimately carry both, so neither may be modelled as “the” confirmation and neither may overwrite the other. Adding a mechanism means adding an optional member here; it never means replacing this type. DESERIALIZED THROUGH ConfirmationWire, for the reason IntrospectionResponse is deserialized through IntrospectionWire, and the member set above is why it has to be separate from that one. cnf is an OBJECT of confirmation methods and each feature registers its own, so a build with dpop and not mtls carries the OUTER member and not the inner one: the guard on IntrospectionWire::cnf passes (the member IS present), the interior deserializes to a Confirmation with nothing in it, and Confirmation::is_empty answers true. That is the certificate-bound-token-read-as-a-bearer-token case in full, arrived at through the guard meant to stop it. The interior needs the same treatment as the exterior, and this is it. #[non_exhaustive]: the paragraph above says adding a sender-constraining mechanism means adding an optional member here, and dpop and mtls each add one INDEPENDENTLY, so there are four different field sets this type has depending on which pair of flags is on. The attribute is what makes that promise cost a host nothing: build with Confirmation::default() (every member is optional by construction) and set the members the mechanism you use registers.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

jkt: Option<String>

Available on crate feature dpop only.

RFC 9449 section 6.1 jkt: the RFC 7638 SHA-256 thumbprint of the client’s proof key, base64url without padding.

x5t_s256: Option<CertificateThumbprint>

Available on crate feature mtls only.

RFC 8705 section 3.1 x5t#S256: the SHA-256 thumbprint of the DER encoding of the X.509 certificate the client presented when the token was issued. A resource server checks it with Confirmation::confirms_certificate.

Implementations

impl Confirmation

pub fn confirms_certificate(&self, der: &[u8]) -> bool

Available on crate feature mtls only.

RESOURCE SERVER side of RFC 8705 section 3: whether the certificate on the connection the token was presented over is the one the token is bound to.

A resource server that has introspected a token (section 3.2 — a channel this server opens to registered resource servers since 0.9.2; see crate::ServerConfig::resource_servers) or verified a JWT (section 3.1) calls this with the DER of the client certificate ITS OWN TLS layer verified. The two halves are equally load bearing, and this method can only do the second one: a certificate the resource server did not verify proves nothing, exactly as set out in this module’s docs.

Answers false for a token that carries no certificate binding at all. That is the safe direction and the only one this method can take: a resource server calling it is asking “is this token bound to my caller”, and an unbound token is not. A resource server that ACCEPTS unbound tokens (a mixed deployment, mid-migration) must ask that question separately, with Confirmation::certificate_thumbprint, rather than reading a false here as permission.

pub fn certificate_thumbprint(&self) -> Option<&CertificateThumbprint>

Available on crate feature mtls only.

The RFC 8705 section 3.1 x5t#S256 this token is bound to, or None for an unbound token.

pub fn for_certificate(certificate: &ClientCertificate<'_>) -> Self

Available on crate feature mtls only.

The confirmation an access token issued over certificate carries (RFC 8705 section 3.1).

The RFC 9449 jkt member, when that feature is also compiled in, is left absent rather than overwritten: a token can be bound by both mechanisms at once and neither owns the object. See Confirmation.

impl Confirmation

pub fn jkt(jkt: impl Into<String>) -> Self

Available on crate feature dpop only.

Wrap a DPoP key thumbprint.

pub fn is_empty(&self) -> bool

Whether this names no confirmation method at all, which is what an ordinary bearer token has. The cnf member is OMITTED for such a token rather than sent as an empty object: an empty cnf claims a constraint exists and then names none, which is worse than silence.

Trait Implementations

impl Clone for Confirmation

fn clone(&self) -> Confirmation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Confirmation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Confirmation

fn default() -> Confirmation

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Confirmation

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Confirmation

impl PartialEq for Confirmation

fn eq(&self, other: &Confirmation) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Confirmation

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Confirmation