Enum IdVerifyError 

pub enum IdVerifyError {
    InvalidFormat,
    SignatureInvalid,
    Expired,
    IssuerInvalid,
    AudienceInvalid,
    MissingClaim(&'static str),
    KeysetUnavailable,
    NonceMissing,
    NonceMismatch,
    AtHashMissing,
    AtHashMismatch,
    CHashMissing,
    CHashMismatch,
    AzpMissing,
    AzpMismatch,
    AuthTimeMissing,
    AuthTimeStale,
    AcrMissing,
    AcrNotAllowed,
    UnknownClaim(String),
    CatMismatch(String),
    Other(String),
}

id_token verification failure surface.

One variant per logical failure class; mirrors VerifyError for access tokens but adds OIDC-specific rows (M66-M73 + M29-mirror CatMismatch). The PAS-engine variants reflect the boundary contract: audit logs map them 1:1 to engine ppoppo_token::id_token::AuthError rows. Adapter-side variants (InvalidFormat) cover failures upstream of engine entry.

Variants

InvalidFormat

Token did not parse as a JWS Compact serialization.

SignatureInvalid

Cryptographic signature verification failed.

Expired

exp claim is in the past.

IssuerInvalid

iss did not match the verifier’s expected issuer.

AudienceInvalid

aud did not match the verifier’s expected audience.

MissingClaim(&'static str)

A required claim was absent or malformed (e.g. sub present but not a parseable ULID, exp/iat outside representable Unix-timestamp range). The variant name is retained for API stability — the error message reflects the dual-purpose semantic.

KeysetUnavailable

JWKS fetch failed and there is no usable cached snapshot.

NonceMissing

M66 — nonce claim is absent from the id_token payload.

NonceMismatch

M66 — payload nonce is present but does not match the expected_nonce the RP stored at the auth-request boundary.

AtHashMissing

M67 — at_hash claim absent from payload while the verifier was configured with an expected access_token binding (hybrid + implicit flows).

AtHashMismatch

M67 — payload at_hash is present but does not match the expected access_token binding.

CHashMissing

M68 — c_hash claim absent while the verifier was configured with an expected authorization-code binding (hybrid flow).

CHashMismatch

M68 — payload c_hash is present but does not match the expected authorization-code binding.

AzpMissing

M69 — azp claim absent on multi-audience id_token.

AzpMismatch

M69 — payload azp does not equal the RP’s client_id.

AuthTimeMissing

M70 — auth_time claim absent while the verifier was configured with a max_age window.

AuthTimeStale

M70 — now - auth_time > max_age. The user authenticated too long ago for this RP’s freshness policy.

AcrMissing

M71 — acr claim absent while the verifier was configured with acr_values.

AcrNotAllowed

M71 — payload acr not in the RP’s acr_values allowlist.

UnknownClaim(String)

M72 — id_token payload contains a claim outside the per-scope allowlist. Carries the offending name for audit log disambiguation (forgery vs issuer drift).

CatMismatch(String)

M29-mirror — id_token payload carries a cat claim whose value is not "id". Refuses access_token shapes presented to the id_token verifier (the symmetric counterpart to M73 on the access-token side). Carries the offending value.

Other(String)

Catch-all for engine variants that don’t map to a structural SDK rejection. Carries the engine’s [AuthError] Display so the audit log retains the precise M-code.

Trait Implementations

impl Clone for IdVerifyError

fn clone(&self) -> IdVerifyError

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IdVerifyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for IdVerifyError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for IdVerifyError

impl Error for IdVerifyError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for IdVerifyError

fn eq(&self, other: &IdVerifyError) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for IdVerifyError