Enum IdTokenFailureKind 

pub enum IdTokenFailureKind {
    NonceMissing,
    NonceMismatch,
    AtHashMissing,
    AtHashMismatch,
    CHashMissing,
    CHashMismatch,
    AzpMissing,
    AzpMismatch,
    AuthTimeMissing,
    AuthTimeStale,
    AcrMissing,
    AcrNotAllowed,
    UnknownClaim(String),
    CatMismatch(String),
}

id_token-specific failure classification (Phase 10.11.B).

Mirrors the OIDC-specific variants of IdVerifyError. Nests inside VerifyErrorKind::IdToken so dashboard pivots can filter “all id_token failures” via a single match arm.

Variants in this enum cover M66-M73 + M29-mirror — JOSE-layer rejections (Expired, SignatureInvalid, etc.) are shared with access_token and remain on the outer VerifyErrorKind flat variants. The boundary mapping (From<&IdVerifyError> for VerifyErrorKind, lands in Phase 10.11.D) routes JOSE rejections to the flat variants and id_token-specific rejections to IdToken(IdTokenFailureKind::*).

Two payload-carrying variants:

• UnknownClaim(String) — engine M72 carries the offending claim name (e.g. "backdoor", "email" at Openid scope). Audit logs distinguish forgery (random key) from issuer drift (legitimate OIDC claim outside scope) by reading the inner string.
• CatMismatch(String) — engine M29-mirror carries the offending cat value (e.g. "access" for an attacker presenting a forged id_token; "" for a stripped-claims forgery; arbitrary string for bespoke forgery).

Variants

NonceMissing

M66 — nonce claim absent.

NonceMismatch

M66 — nonce claim present but does not match expected.

AtHashMissing

M67 — at_hash claim absent while access_token binding is configured.

AtHashMismatch

M67 — at_hash claim present but does not match.

CHashMissing

M68 — c_hash claim absent while authorization_code binding is configured.

CHashMismatch

M68 — c_hash claim present but does not match.

AzpMissing

M69 — azp claim absent on multi-aud id_token.

AzpMismatch

M69 — azp claim present but does not equal expected client_id.

AuthTimeMissing

M70 — auth_time claim absent while max_age is configured.

AuthTimeStale

M70 — now - auth_time > max_age.

AcrMissing

M71 — acr claim absent while acr_values is configured.

AcrNotAllowed

M71 — acr claim present but not in allowlist.

UnknownClaim(String)

M72 — claim name outside per-scope allowlist. Carries name.

CatMismatch(String)

M29-mirror — cat claim value is not "id". Carries the offending value.

Trait Implementations

impl Clone for IdTokenFailureKind

fn clone(&self) -> IdTokenFailureKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IdTokenFailureKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for IdTokenFailureKind

fn deserialize<__D>( __deserializer: __D, ) -> Result<IdTokenFailureKind, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for IdTokenFailureKind

fn eq(&self, other: &IdTokenFailureKind) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for IdTokenFailureKind

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for IdTokenFailureKind

impl StructuralPartialEq for IdTokenFailureKind