Crate pep 

PEP - Policy Enforcement Point

A Rust library for OIDC authentication and authorization, providing both client-side authentication flows and resource server protection.

Features

• oidc-client: OIDC client functionality for web applications
• oidc-resource-server: JWT validation middleware for API protection
• oidc: Enables both client and resource server features
• axum: Axum web framework integration (extractors, bearer token helpers)
• authorization: Authorization helpers and middleware for role and scope verification
• config: Standardized configuration parsing from TOML files
• rfc9728: RFC 9728 Protected Resource Metadata support
• cedar: AWS Cedar ABAC policy engine for fine-grained authorization

Example (Resource Server with Axum)

use pep::axum::{JwtClaimsExtractor, extract_bearer_token};
use pep::oidc_resource_server::ResourceServerClient;

async fn protected_handler(claims: JwtClaimsExtractor) -> String {
    format!("Hello, {}!", claims.sub)
}

Example (Development Mode)

use pep::DevConfig;

let dev = DevConfig::enabled();
let claims = dev.create_dev_claims();
assert_eq!(claims.iss, "dev");

Re-exports

pub use error::PepError;

pub use error::Result;

pub use axum_integration as axum;

pub use config::PepConfig;

pub use config::OidcConfig;

pub use config::OidcDevConfig;

pub use config::load_config;

pub use crate::oidc::types::JwtClaims;

pub use crate::oidc::types::OidcDiscoveryDocument;

pub use crate::oidc::types::DevConfig;

pub use crate::oidc::types::OidcClientConfig;

pub use crate::oidc::types::JwtValidationOptions;

pub use crate::oidc::types::ResourceServerConfig;

pub use crate::oidc::types::CachedJwks;

pub use crate::oidc::types::CachedDiscoveryRaw;

pub use crate::oidc::resource_server::CachedUserInfo;

pub use crate::oidc::resource_server::UserInfoCache;

pub use axum_integration::JwtClaimsExtractor;

pub use axum_integration::extract_bearer_token;

pub use auth::AuthorizationError;

pub use auth::RequireRole;

pub use auth::RequireScope;

pub use rfc9728::ProtectedResourceMetadata;

pub use rfc9728::PrmConfig;

pub use rfc9728::prm_handler;

pub use rfc9728::prm_route;

pub use cedar::CedarAuthorizer;

pub use cedar::CedarConfig;

pub use cedar::CedarError;

pub use cedar::DefaultDecision;

pub use cedar::PolicyStoreClient;

pub use cedar::PolicyStoreResponse;

pub use token_provider::TokenProvider;

pub use token_provider::TokenProviderEnum;

pub use token_provider::StaticTokenProvider;

pub use token_provider::ServiceAccountTokenProvider;

pub use token_provider::ServiceAccountConfig;

pub use token_provider::InteractiveConfig;

pub use token_provider::InteractiveTokenProvider;

pub use token_store::TokenStore;

pub use token_store::FileTokenStore;

pub use token_store::MemoryTokenStore;

pub use token_store::StoredToken;

pub use session_manager::WebSessionManager;

pub use session_manager::InMemoryTokenStore;

pub use oauth_callback::CallbackServer;

pub use oauth_callback::AuthorizationCode;

Modules

auth

Authorization helpers and middleware for role and scope verification

axum_integration

Axum integration for PEP authentication

cedar

Cedar ABAC Module for PEP

config

Configuration parsing module for PEP

error

Error types for PEP operations

oauth_callback

OAuth callback HTTP server for interactive authentication flows.

oidc

OIDC authentication and authorization functionality

oidc_client

OIDC client functionality

oidc_resource_server

OIDC resource server functionality

rfc9728

RFC 9728: OAuth 2.0 Protected Resource Metadata

session_manager

Web session management with server-side token storage and auto-refresh.

token_provider

Token Provider module for managing authentication token lifecycle.

token_store

Token storage for persistent OAuth tokens.