Struct openid_client::client::Client
source · pub struct Client { /* private fields */ }Expand description
§Client instance
Implementations§
source§impl Client
impl Client
sourcepub fn get_other_fields(&self) -> &HashMap<String, Value>
pub fn get_other_fields(&self) -> &HashMap<String, Value>
Gets the extra fields in client
source§impl Client
impl Client
Implementation for Client Read Methods
sourcepub async fn from_uri_async(
registration_client_uri: &str,
issuer: &Issuer,
registration_access_token: Option<String>,
jwks: Option<Jwks>,
client_options: Option<ClientOptions>,
interceptor: Option<RequestInterceptor>,
fapi: Option<Fapi>
) -> Result<Self, OidcClientError>
pub async fn from_uri_async( registration_client_uri: &str, issuer: &Issuer, registration_access_token: Option<String>, jwks: Option<Jwks>, client_options: Option<ClientOptions>, interceptor: Option<RequestInterceptor>, fapi: Option<Fapi> ) -> Result<Self, OidcClientError>
§Creates a client from the Client Read Endpoint
Creates a Client from the Client read endpoint.
registration_client_uri- The client read endpointregistration_access_token- The access token to be sent with the requestjwks- Private Jwks of the clientclient_options- The ClientOptionsissuer- Issuerinterceptor- See RequestInterceptor docs for setting up an interceptor.fapi- Fapi version.
§Example:
let issuer = Issuer::discover_async("https://auth.example.com", None)
.await
.unwrap();
let _client = Client::from_uri_async(
"https://auth.example.com/client/id",
&issuer,
None,
None,
None,
None,
None,
)
.await
.unwrap();§Example: with other params
let mut jwk = Jwk::generate_rsa_key(2048).unwrap();
jwk.set_algorithm("PS256");
let jwks = Jwks::from(vec![jwk]);
let client_options = ClientOptions {
additional_authorized_parties: Some(vec!["authParty".to_string()]),
};
let issuer = Issuer::discover_async("https://auth.example.com", None)
.await
.unwrap();
let _client = Client::from_uri_async(
"https://auth.example.com/client/id",
&issuer,
Some("token".to_string()),
Some(jwks),
Some(client_options),
None,
None,
)
.await
.unwrap();source§impl Client
impl Client
Implementations for Dynamic Client Registration
sourcepub async fn register_async(
issuer: &Issuer,
client_metadata: ClientMetadata,
register_options: Option<ClientRegistrationOptions>,
interceptor: Option<RequestInterceptor>,
fapi: Option<Fapi>
) -> Result<Self, OidcClientError>
pub async fn register_async( issuer: &Issuer, client_metadata: ClientMetadata, register_options: Option<ClientRegistrationOptions>, interceptor: Option<RequestInterceptor>, fapi: Option<Fapi> ) -> Result<Self, OidcClientError>
§Dynamic Client Registration
Attempts a Dynamic Client Registration using the Issuer’s registration_endpoint
issuer- The Issuer client should be registered to.client_metadata- The ClientMetadata to be sent using the registration request.register_options- ClientRegistrationOptionsinterceptor- See RequestInterceptor docs for setting up an interceptor.fapi- Fapi version.
§Example:
let issuer = Issuer::discover_async("https://auth.example.com", None)
.await
.unwrap();
let metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
..ClientMetadata::default()
};
let _client = Client::register_async(&issuer, metadata, None, None, None)
.await
.unwrap();§Example: with other params
let issuer = Issuer::discover_async("https://auth.example.com", None)
.await
.unwrap();
let metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
..ClientMetadata::default()
};
let mut jwk = Jwk::generate_rsa_key(2048).unwrap();
jwk.set_algorithm("PS256");
let registration_options = ClientRegistrationOptions {
initial_access_token: Some("initial_access_token".to_string()),
jwks: Some(Jwks::from(vec![jwk])),
client_options: Default::default(),
};
let _client = Client::register_async(&issuer, metadata, Some(registration_options), None, None)
.await
.unwrap();sourcepub fn metadata(&self) -> ClientMetadata
pub fn metadata(&self) -> ClientMetadata
§Get Client Metadata
Gets the ClientMetadata of this Client instance
source§impl Client
impl Client
Implementation for Client
§Authorization Url
Builds an authorization url with respect to the parameters
parameters- AuthorizationParameters : Customize the authorization request
§Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
authorization_endpoint: Some("https://auth.example.com/auth".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
..Default::default()
};
let client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let _url = client
.authorization_url(AuthorizationParameters::default())
.unwrap();sourcepub fn end_session_url(
&self,
parameters: EndSessionParameters
) -> Result<Url, OidcClientError>
pub fn end_session_url( &self, parameters: EndSessionParameters ) -> Result<Url, OidcClientError>
§End Session Url
Builds an endsession url with respect to the parameters
parameters- EndSessionParameters : Customize the endsession url
§Example:
let issuer_metadata = IssuerMetadata {
end_session_endpoint: Some("https://auth.example.com/end".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
..Default::default()
};
let client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let _url = client
.end_session_url(EndSessionParameters::default())
.unwrap();§Authorization Post
Builds an authorization post page with respect to the parameters
parameters- AuthorizationParameters : Customize the authorization request
§Example:
let issuer_metadata = IssuerMetadata {
authorization_endpoint: Some("https://auth.example.com/auth".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
..Default::default()
};
let client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let _html = client
.authorization_post(AuthorizationParameters::default())
.unwrap();sourcepub fn grant_async<'life_self, 'async_recursion>(
&'life_self mut self,
body: HashMap<String, String>,
extras: GrantExtras<'async_recursion>,
retry: bool
) -> Pin<Box<dyn Future<Output = Result<TokenSet, OidcClientError>> + 'async_recursion>>where
'life_self: 'async_recursion,
pub fn grant_async<'life_self, 'async_recursion>(
&'life_self mut self,
body: HashMap<String, String>,
extras: GrantExtras<'async_recursion>,
retry: bool
) -> Pin<Box<dyn Future<Output = Result<TokenSet, OidcClientError>> + 'async_recursion>>where
'life_self: 'async_recursion,
§Token Grant
Performs a grant at the crate::types::IssuerMetadata::token_endpoint
body- HashMap<String, Value> : Request bodyextras- GrantExtras : Parameters for customizing auth requestretry- Will retry exactly once if true.
§Example:
let issuer_metadata = IssuerMetadata {
token_endpoint: Some("https://auth.example.com/token".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
..Default::default()
};
let mut client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let body: HashMap<String, String> = HashMap::new();
let _token_set = client
.grant_async(body, GrantExtras::default(), true)
.await
.unwrap();sourcepub async fn oauth_callback_async(
&mut self,
redirect_uri: Option<&str>,
parameters: CallbackParams,
checks: Option<OAuthCallbackChecks<'_>>,
extras: Option<CallbackExtras>
) -> Result<TokenSet, OidcClientError>
pub async fn oauth_callback_async( &mut self, redirect_uri: Option<&str>, parameters: CallbackParams, checks: Option<OAuthCallbackChecks<'_>>, extras: Option<CallbackExtras> ) -> Result<TokenSet, OidcClientError>
§OAuth Callback
Performs the callback for Authorization Server’s authorization response.
redirect_uri- The redirect uri of the Clientparameters- CallbackParams : Parameters recieved from the callback responsechecks- OAuthCallbackChecks : Checks to be performed againstparamsextras- CallbackExtras : Extra details to be used for token grant
§Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
token_endpoint: Some("https://auth.example.com/token".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
client_secret: Some("secure".to_string()),
..Default::default()
};
let mut client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let callback_params = CallbackParams {
code: Some("code".to_string()),
..Default::default()
};
let checks = OAuthCallbackChecks {
response_type: Some("code"),
..Default::default()
};
let _token_set = client
.oauth_callback_async(
Some("https://rp.example.com/cb"),
callback_params,
Some(checks),
None,
)
.await
.unwrap();sourcepub fn set_skip_max_age_check(&mut self, max_age_check: bool)
pub fn set_skip_max_age_check(&mut self, max_age_check: bool)
§Skip Max Age Check
When skip_max_age_check is set to true, Id Token’s
Max age wont be validated
sourcepub fn set_skip_nonce_check(&mut self, nonce_check: bool)
pub fn set_skip_nonce_check(&mut self, nonce_check: bool)
§Skip Nonce Check
When skip_nonce_check is set to true, Id token’s
Nonce wont be validated
sourcepub fn set_clock_skew_duration(&mut self, duration: Duration)
pub fn set_clock_skew_duration(&mut self, duration: Duration)
§Set Clock Skew
It is possible the RP or OP environment has a system clock skew, which can result in the error “JWT not active yet”.
sourcepub async fn callback_async(
&mut self,
redirect_uri: Option<&str>,
parameters: CallbackParams,
checks: Option<OpenIDCallbackChecks<'_>>,
extras: Option<CallbackExtras>
) -> Result<TokenSet, OidcClientError>
pub async fn callback_async( &mut self, redirect_uri: Option<&str>, parameters: CallbackParams, checks: Option<OpenIDCallbackChecks<'_>>, extras: Option<CallbackExtras> ) -> Result<TokenSet, OidcClientError>
§Callback
Performs the callback for Authorization Server’s authorization response.
redirect_uri- The redirect uri of the Clientparameters- CallbackParams : Parameters recieved from the callback responsechecks- OpenIDCallbackChecks : Checks to be performed againstparamsextras- CallbackExtras : Extra details to be used for token grant
§Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
token_endpoint: Some("https://auth.example.com/token".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
client_secret: Some("secure".to_string()),
..Default::default()
};
let mut client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let callback_params = CallbackParams {
code: Some("code".to_string()),
..Default::default()
};
let checks = OpenIDCallbackChecks {
max_age: Some(300),
oauth_checks: Some(OAuthCallbackChecks {
state: Some("state"),
..Default::default()
}),
..Default::default()
};
let _token_set = client
.callback_async(
Some("https://rp.example.com/cb"),
callback_params,
Some(checks),
None,
)
.await
.unwrap();sourcepub async fn introspect_async(
&mut self,
token: String,
token_type_hint: Option<String>,
extras: Option<IntrospectionExtras>
) -> Result<Response, OidcClientError>
pub async fn introspect_async( &mut self, token: String, token_type_hint: Option<String>, extras: Option<IntrospectionExtras> ) -> Result<Response, OidcClientError>
§Introspect
Performs an introspection request at Issuer::introspection_endpoint
token: The token to introspecttoken_type_hint: Type of the token passed intoken. Usuallyaccess_tokenorrefresh_tokenextras: See IntrospectionExtras
§Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
introspection_endpoint: Some("https://auth.example.com/introspect".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
client_secret: Some("secure".to_string()),
..Default::default()
};
let mut client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let extras = IntrospectionExtras {
client_assertion_payload: Some(HashMap::new()),
introspect_body: Some(HashMap::new()),
};
let introspection_response = client
.introspect_async("token".to_string(), Some("hint".to_string()), Some(extras))
.await
.unwrap();
let _body = introspection_response.body;
let _headers = introspection_response.headers;
let _status = introspection_response.status;sourcepub fn request_resource_async<'life0, 'life1, 'life_self, 'async_recursion>(
&'life_self mut self,
resource_url: &'life0 str,
access_token: &'life1 str,
token_type: Option<&'async_recursion str>,
retry: bool,
options: RequestResourceOptions<'async_recursion>
) -> Pin<Box<dyn Future<Output = Result<Response, OidcClientError>> + 'async_recursion>>where
'life0: 'async_recursion,
'life1: 'async_recursion,
'life_self: 'async_recursion,
pub fn request_resource_async<'life0, 'life1, 'life_self, 'async_recursion>(
&'life_self mut self,
resource_url: &'life0 str,
access_token: &'life1 str,
token_type: Option<&'async_recursion str>,
retry: bool,
options: RequestResourceOptions<'async_recursion>
) -> Pin<Box<dyn Future<Output = Result<Response, OidcClientError>> + 'async_recursion>>where
'life0: 'async_recursion,
'life1: 'async_recursion,
'life_self: 'async_recursion,
§Request Resource
Performs a request to fetch using the access token at resource_url.
resource_url: Url of the resource serveraccess_token: Token to authenticate the resource fetch requesttoken_type: Type of thetoken. Eg:Bearer,DPoPretry: Whether to retry if the request failed or notoptions: See RequestResourceOptions
§Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
client_secret: Some("secure".to_string()),
..Default::default()
};
let mut client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let resource_response = client
.request_resource_async(
"https://resource.example.com/resource",
"token",
Some("Bearer"),
true,
RequestResourceOptions::default(),
)
.await
.unwrap();
let _body = resource_response.body;
let _headers = resource_response.headers;
let _status = resource_response.status;sourcepub fn callback_params(
&self,
incoming_url: Option<&Url>,
incoming_body: Option<String>
) -> Result<CallbackParams, OidcClientError>
pub fn callback_params( &self, incoming_url: Option<&Url>, incoming_body: Option<String> ) -> Result<CallbackParams, OidcClientError>
§Callback Params
Tries to convert the Url or a body string to CallbackParams
incoming_url: The full url of the request (Url). Use this param if the request is of the type GETincoming_body: Incoming body. Use this param if the request is of the type POST
Only one of the above parameter is parsed.
###Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
client_secret: Some("secure".to_string()),
..Default::default()
};
let client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let _params = client
.callback_params(None, Some("code=123&id_token=token".to_string()))
.unwrap();
// Or
let _params = client
.callback_params(
Some(
&"https:://example.com/cb?code=123&id_token=token"
.parse()
.unwrap(),
),
None,
)
.unwrap();sourcepub async fn refresh_async(
&mut self,
token_set: TokenSet,
extras: Option<RefreshTokenExtras<'_>>
) -> Result<TokenSet, OidcClientError>
pub async fn refresh_async( &mut self, token_set: TokenSet, extras: Option<RefreshTokenExtras<'_>> ) -> Result<TokenSet, OidcClientError>
§Refresh Request
Performs a Token Refresh request at Issuer’s token_endpoint
token_set: TokenSet with refresh token that will be used to perform the requestextras: See RefreshTokenExtras
###Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
token_endpoint: Some("https://auth.example.com/token".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
client_secret: Some("larger_than_32_char_client_secret".to_string()),
id_token_signed_response_alg: Some("HS256".to_string()),
..Default::default()
};
let mut client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let params = TokenSetParams {
id_token: Some("id_token".to_string()),
refresh_token: Some("refresh".to_string()),
..Default::default()
};
let old_token_set = TokenSet::new(params);
// let mut jwk = Jwk::generate_rsa_key(2048).unwrap();
// jwk.set_algorithm("PS256");
let extras = RefreshTokenExtras {
client_assertion_payload: Some(HashMap::new()),
exchange_body: Some(HashMap::new()),
// dpop: Some(&jwk),
dpop: None,
};
let _token_set = client
.refresh_async(old_token_set, Some(extras))
.await
.unwrap();sourcepub async fn revoke_async(
&mut self,
token: &str,
token_type_hint: Option<&str>,
extras: Option<RevokeExtras>
) -> Result<Response, OidcClientError>
pub async fn revoke_async( &mut self, token: &str, token_type_hint: Option<&str>, extras: Option<RevokeExtras> ) -> Result<Response, OidcClientError>
§Revoke Token
Performs a token revocation at Issuer’s revocation_endpoint
token: The token to be revokedtoken_type_hint: Hint to which type of token is being revokedextras: See RevokeExtras
###Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
revocation_endpoint: Some("https://auth.example.com/token/revoke".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
token_endpoint_auth_method: Some("none".to_string()),
..Default::default()
};
let mut client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let extras = RevokeExtras {
client_assertion_payload: Some(HashMap::new()),
revocation_body: Some(HashMap::new()),
};
let revoke_response = client
.revoke_async("token", Some("hint"), Some(extras))
.await
.unwrap();
let _body = revoke_response.body; // Should be None
let _headers = revoke_response.headers;
let _status = revoke_response.status;sourcepub async fn userinfo_async(
&mut self,
token_set: &TokenSet,
options: UserinfoOptions<'_>
) -> Result<Value, OidcClientError>
pub async fn userinfo_async( &mut self, token_set: &TokenSet, options: UserinfoOptions<'_> ) -> Result<Value, OidcClientError>
§Userinfo
Performs userinfo request at Issuer’s userinfo endpoint.
token_set: TokenSet withaccess_tokenthat will be used to perform the requestoptions: See UserinfoOptions
###Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
userinfo_endpoint: Some("https://auth.example.com/me".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
id_token_signed_response_alg: Some("none".to_string()),
..Default::default()
};
let params = TokenSetParams {
id_token: Some("id_token".to_string()),
refresh_token: Some("refresh".to_string()),
..Default::default()
};
let token_set = TokenSet::new(params);
let mut client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
// let mut jwk = Jwk::generate_rsa_key(2048).unwrap();
// jwk.set_algorithm("PS256");
let options = UserinfoOptions {
params: Some(HashMap::new()),
method: "POST",
via: "body",
// dpop: Some(&jwk),
dpop: None,
};
let _serde_json_value = client.userinfo_async(&token_set, options).await.unwrap();sourcepub async fn request_object_async(
&mut self,
request_object: Value
) -> Result<String, OidcClientError>
pub async fn request_object_async( &mut self, request_object: Value ) -> Result<String, OidcClientError>
§Request Object
Creates a request object for JAR
request_object: A Value which should be an object
###Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
jwks_uri: Some("https://auth.example.com/certs".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
request_object_signing_alg: Some("EdDSA".to_string()),
..Default::default()
};
let mut client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let req_object = json!({
"scope": "read write",
"response_type": "code",
"redirect_uri": "https://example.com",
"state": "93d33d57-59c7-4b41-9a15-80e2ed1482e2",
"client_id": "123"
});
let _request_object_jwt = client.request_object_async(req_object).await.unwrap();§Pushed Authorization Request
Performs a PAR on the pushed_authorization_request_endpoint
parameters: See AuthorizationParametersextras: See PushedAuthorizationRequestExtras
###Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
pushed_authorization_request_endpoint: Some("https://auth.example.com/par".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
client_secret: Some("secure".to_string()),
response_type: Some("code".to_string()),
grant_types: Some(vec!["authrorization_code".to_string()]),
redirect_uri: Some("https://example.com/cb".to_string()),
..Default::default()
};
let mut client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let auth_params = AuthorizationParameters {
scope: Some(vec!["some".to_string()]),
..Default::default()
};
// let mut jwk = Jwk::generate_rsa_key(2048).unwrap();
// jwk.set_algorithm("PS256");
let extras = PushedAuthorizationRequestExtras {
client_assertion_payload: Some(HashMap::new()),
// dpop: Some(&jwk),
dpop: None,
};
let _request_object_jwt = client
.pushed_authorization_request_async(Some(auth_params), Some(extras))
.await
.unwrap();§Device Authorization Grant
Performs a Device Authorization Grant at device_authorization_request_endpoint.
params- See DeviceAuthorizationParamsextras- See DeviceAuthorizationExtras
###Example:
let issuer_metadata = IssuerMetadata {
issuer: "https://auth.example.com".to_string(),
device_authorization_endpoint: Some("https://auth.example/device".to_string()),
token_endpoint: Some("https://op.example.com/token".to_string()),
..Default::default()
};
let issuer = Issuer::new(issuer_metadata, None);
let client_metadata = ClientMetadata {
client_id: Some("identifier".to_string()),
client_secret: Some("secure".to_string()),
..Default::default()
};
let mut client = issuer
.client(client_metadata, None, None, None, None)
.unwrap();
let mut other = HashMap::new();
other.insert("acr_values".to_string(), json!(["acr1"]));
other.insert("claims_locales".to_string(), json!(["some"]));
let params = DeviceAuthorizationParams {
client_id: Some("client_id".to_string()), // not necessary
scope: Some(vec!["some".to_string()]),
max_age: Some(300),
// Authorization Paramters for the auth request is extracted from other
other,
};
// let mut jwk = Jwk::generate_rsa_key(2048).unwrap();
// jwk.set_algorithm("PS256");
let extras = DeviceAuthorizationExtras {
client_assertion_payload: Some(HashMap::new()),
exchange_body: Some(HashMap::new()),
// dpop: Some(&jwk),
dpop: None,
};
let mut device_flow_handle = client
.device_authorization_async(params, Some(extras))
.await
.unwrap();
let _device_grant_response = device_flow_handle.grant_async();