Struct openid_client::issuer::Issuer

source ·

pub struct Issuer {
    pub introspection_endpoint: Option<String>,
    /* private fields */
}

Expand description

Holds all the discovered values from the OIDC Issuer

Fields§

§introspection_endpoint: Option<String>

Token introspection endpoint

Implementations§

source §

impl Issuer

Issuer Instance Creation

source

pub fn new( metadata: IssuerMetadata, interceptor: Option<RequestInterceptor> ) -> Self

Issuer

Create an Issuer instance using IssuerMetadata.

metadata - IssuerMetadata
interceptor - RequestInterceptor

No OIDC Discovery defaults are set if Issuer is created using this method.

If no introspection/revocation endpoint auth methods or algorithms are specified, value of token endpoint auth methods and algorithms are used as the the value for the said properties.

Example:

    let metadata = IssuerMetadata {
        issuer: "https://auth.example.com".to_string(),
        authorization_endpoint: Some("https://auth.example.com/authorize".to_string()),
        token_endpoint: Some("https://auth.example.com/token".to_string()),
        userinfo_endpoint: Some("https://auth.example.com/userinfo".to_string()),
        jwks_uri: Some("https://auth.example.com/certs".to_string()),
        ..IssuerMetadata::default()
    };

    let issuer = Issuer::new(metadata, None);

Example: with a request interceptor

    let metadata = IssuerMetadata {
        issuer: "https://auth.example.com".to_string(),
        authorization_endpoint: Some("https://auth.example.com/authorize".to_string()),
        token_endpoint: Some("https://auth.example.com/token".to_string()),
        userinfo_endpoint: Some("https://auth.example.com/userinfo".to_string()),
        jwks_uri: Some("https://auth.example.com/certs".to_string()),
        ..IssuerMetadata::default()
    };

   #[derive(Debug, Clone)]
   pub(crate) struct CustomInterceptor {
       pub some_header: String,
       pub some_header_value: String,
   }

   impl Interceptor for CustomInterceptor {
       fn intercept(&mut self, _req: &Request) -> RequestOptions {
           let mut headers: HeaderMap = HeaderMap::new();

           let header = HeaderName::from_bytes(self.some_header.as_bytes()).unwrap();
           let header_value = HeaderValue::from_bytes(self.some_header_value.as_bytes()).unwrap();

           headers.append(header, header_value);

           RequestOptions {
               headers,
               timeout: Duration::from_millis(5000),
               ..Default::default()
           }
       }

       fn clone_box(&self) -> Box<dyn Interceptor> {
           Box::new(CustomInterceptor {
               some_header: self.some_header.clone(),
               some_header_value: self.some_header_value.clone(),
           })
       }
   }

   let interceptor = CustomInterceptor {
       some_header: "foo".to_string(),
       some_header_value: "bar".to_string(),
   };

    let issuer = Issuer::new(metadata, Some(Box::new(interceptor)));

    // Get jwks request will send the header foo: bar in the request
    let _ = issuer.get_jwks();

source §

impl Issuer

OIDC Issuer Discovery

source

pub async fn discover_async( issuer: &str, interceptor: Option<RequestInterceptor> ) -> Result<Issuer, OidcClientError>

Discover OIDC Issuer

Discover an OIDC Issuer using the issuer url.

issuer - The issuer url (absolute).
interceptor - RequestInterceptor

Only an absolute urls are accepted, passing in auth.example.com will result in an error.

Example:

    let _ = Issuer::discover_async("https://auth.example.com", None)
        .await
        .unwrap();

Example: with .well-known/openid-configuration

Urls with .well-known/openid-configuration can also be used to discover issuer.

    let _ = Issuer::discover_async(
        "https://auth.example.com/.well-known/openid-configuration",
        None,
    )
    .await
    .unwrap();

Example: with interceptor


   #[derive(Debug, Clone)]
   pub(crate) struct CustomInterceptor {
       pub some_header: String,
       pub some_header_value: String,
   }

   impl Interceptor for CustomInterceptor {
       fn intercept(&mut self, _req: &Request) -> RequestOptions {
           let mut headers: HeaderMap = HeaderMap::new();

           let header = HeaderName::from_bytes(self.some_header.as_bytes()).unwrap();
           let header_value = HeaderValue::from_bytes(self.some_header_value.as_bytes()).unwrap();

           headers.append(header, header_value);

           RequestOptions {
               headers,
               timeout: Duration::from_millis(5000),
               ..Default::default()
           }
       }

       fn clone_box(&self) -> Box<dyn Interceptor> {
           Box::new(CustomInterceptor {
               some_header: self.some_header.clone(),
               some_header_value: self.some_header_value.clone(),
           })
       }
   }

   let interceptor = CustomInterceptor {
       some_header: "foo".to_string(),
       some_header_value: "bar".to_string(),
   };

    // The discovery request will send header foo: bar in the request headers

    let _ = Issuer::discover_async(
        "https://auth.example.com/.well-known/openid-configuration",
        Some(Box::new(interceptor)),
    )
    .await
    .unwrap();

source §

impl Issuer

OIDC Issuer Webfinger Discovery

source

pub async fn webfinger_async( input: &str, interceptor: Option<RequestInterceptor> ) -> Result<Issuer, OidcClientError>

Webfinger OIDC Issuer Discovery

Discover an OIDC Issuer using the user email, url, url with port syntax or acct syntax.

input - The resource.
interceptor - RequestInterceptor

Example:

#[tokio::main]
async fn main() {
    let _issuer_email = Issuer::webfinger_async("joe@auth.example.com", None)
        .await
        .unwrap();
    let _issuer_url = Issuer::webfinger_async("https://auth.example.com/joe", None)
        .await
        .unwrap();
    let _issuer_url_port = Issuer::webfinger_async("auth.example.com:3000/joe", None)
        .await
        .unwrap();
    let _issuer_acct_email = Issuer::webfinger_async("acct:joe@auth.example.com", None)
        .await
        .unwrap();
    let _issuer_acct_host = Issuer::webfinger_async("acct:auth.example.com", None)
        .await
        .unwrap();
}

Example: with interceptor

    // This interceptor will insert a header foo: bar for the discovery request made
    // internally after webfinger request

   #[derive(Debug, Clone)]
   pub(crate) struct CustomInterceptor {
       pub some_header: String,
       pub some_header_value: String,
   }

   impl Interceptor for CustomInterceptor {
       fn intercept(&mut self, _req: &Request) -> RequestOptions {
           let mut headers: HeaderMap = HeaderMap::new();

           let header = HeaderName::from_bytes(self.some_header.as_bytes()).unwrap();
           let header_value = HeaderValue::from_bytes(self.some_header_value.as_bytes()).unwrap();

           headers.append(header, header_value);

           RequestOptions {
               headers,
               timeout: Duration::from_millis(5000),
               ..Default::default()
           }
       }

       fn clone_box(&self) -> Box<dyn Interceptor> {
           Box::new(CustomInterceptor {
               some_header: self.some_header.clone(),
               some_header_value: self.some_header_value.clone(),
           })
       }
   }

   let interceptor = CustomInterceptor {
       some_header: "foo".to_string(),
       some_header_value: "bar".to_string(),
   };

    let _issuer = Issuer::webfinger_async("joe@auth.example.com", Some(Box::new(interceptor)))
        .await
        .unwrap();

source §

impl Issuer

New Client implementation for Issuer

source

pub fn client( &self, metadata: ClientMetadata, interceptor: Option<RequestInterceptor>, jwks: Option<Jwks>, client_options: Option<ClientOptions>, is_fapi: bool ) -> Result<Client, OidcClientError>

Creates a client from the issuer

This method creates a new Client from the issuer. A client metadata with a required client_id field is also required

metadata - ClientMetadata
interceptor - RequestInterceptor
jwks - The client jwks with private keys.
client_options - Client options.
is_fapi - Marks the client as FAPI client

Note: If the Issuer already have a request interceptor and none was passed in through interceptor, the interceptor from the Issuer is used.

Example:

    let issuer = Issuer::discover("https://auth.example.com", None).unwrap();
     
    let client_metadata = ClientMetadata {
        client_id: Some("client_id".to_string()),
        ..ClientMetadata::default()
    };
     
    let _client = issuer.client(client_metadata, None, None, None, false).unwrap();

Example: with jwks

    let issuer = Issuer::discover("https://auth.example.com", None).unwrap();

    let client_metadata = ClientMetadata {
        client_id: Some("client_id".to_string()),
        ..ClientMetadata::default()
    };

    let jwk = jwk::Jwk::generate_rsa_key(2048).unwrap();

    let jwks = Jwks::from(vec![jwk]);

    let _client = issuer
        .client(client_metadata, None, Some(jwks), None, false)
        .unwrap();

Example: with all params

    let issuer = Issuer::discover("https://auth.example.com", None).unwrap();

    // Adds a foo: bar header for all urls that contains `userinfo`

   #[derive(Debug, Clone)]
   pub(crate) struct CustomInterceptor {
       pub some_header: String,
       pub some_header_value: String,
   }

   impl Interceptor for CustomInterceptor {
       fn intercept(&mut self, _req: &Request) -> RequestOptions {
           let mut headers: HeaderMap = HeaderMap::new();

           let header = HeaderName::from_bytes(self.some_header.as_bytes()).unwrap();
           let header_value = HeaderValue::from_bytes(self.some_header_value.as_bytes()).unwrap();

           headers.append(header, header_value);

           RequestOptions {
               headers,
               timeout: Duration::from_millis(5000),
               ..Default::default()
           }
       }

       fn clone_box(&self) -> Box<dyn Interceptor> {
           Box::new(CustomInterceptor {
               some_header: self.some_header.clone(),
               some_header_value: self.some_header_value.clone(),
           })
       }
   }

   let interceptor = CustomInterceptor {
       some_header: "foo".to_string(),
       some_header_value: "bar".to_string(),
   };

    let jwk = Jwk::generate_rsa_key(2048).unwrap();

    let jwks = Jwks::from(vec![jwk]);

    let client_options = ClientOptions {
        additional_authorized_parties: Some(vec!["authParty".to_string()]),
    };

    let client_metadata = ClientMetadata {
        client_id: Some("client_id".to_string()),
        ..ClientMetadata::default()
    };

    let _client = issuer
        .client(
        client_metadata,
        Some(Box::new(interceptor)),
        Some(jwks),
        Some(client_options),
        false)
        .unwrap();