Struct ResourceServerClient 

pub struct ResourceServerClient {
    pub http_client: Client,
    pub jwks_cache: Arc<RwLock<HashMap<String, CachedJwks>>>,
    pub discovery_cache: Arc<RwLock<HashMap<String, (OidcDiscoveryDocument, SystemTime)>>>,
    pub discovery_cache_raw: Arc<RwLock<HashMap<String, CachedDiscoveryRaw>>>,
    pub userinfo_cache: Arc<UserInfoCache>,
}

Resource server client for JWT validation

Fields

http_client: Client

HTTP client

jwks_cache: Arc<RwLock<HashMap<String, CachedJwks>>>

JWKS cache

discovery_cache: Arc<RwLock<HashMap<String, (OidcDiscoveryDocument, SystemTime)>>>

Discovery document cache (parsed)

discovery_cache_raw: Arc<RwLock<HashMap<String, CachedDiscoveryRaw>>>

Discovery document cache (raw JSON for proxying)

userinfo_cache: Arc<UserInfoCache>

Userinfo response cache (keyed by jti/sub, TTL = token remaining lifetime)

Implementations

impl ResourceServerClient

pub fn new() -> Self

Create a new resource server client

pub async fn get_discovery_document( &self, issuer_url: &str, ) -> Result<OidcDiscoveryDocument>

Fetch OIDC discovery document with caching

pub async fn get_discovery_document_raw( &self, issuer_url: &str, ) -> Result<String>

Fetch OIDC discovery document as raw JSON with caching

pub async fn get_jwks( &self, jwks_uri: &str, ) -> Result<HashMap<String, (DecodingKey, Algorithm)>>

Fetch JWKS with caching

pub async fn validate_jwt_with_options( &self, token: &str, issuer_url: &str, client_id: &str, options: &JwtValidationOptions, ) -> Result<JwtClaims>

Validate JWT token with custom validation options

pub async fn validate_jwt( &self, token: &str, issuer_url: &str, client_id: &str, ) -> Result<JwtClaims>

Validate JWT token with default options

pub async fn enrich_claims_with_userinfo( &self, claims: &mut JwtClaims, token: &str, issuer_url: &str, userinfo_url_override: Option<&str>, ) -> Result<()>

Adaptive claims enrichment: fill missing groups / role from the OIDC /userinfo endpoint.

IdP-agnostic design:

1. If claims.extra already contains groups or role, use them directly (zero cost).
2. Otherwise, call the /userinfo endpoint with the access token as Bearer.
3. Merge groups and role from userinfo into claims.extra.
4. Cache the userinfo response by jti (or sub fallback) until the token expires.

This works with Kanidm (no groups in AT), Keycloak/Auth0 (groups in AT → fast path), Okta, Azure AD, Google, and any other OIDC-compliant provider.

Arguments

• claims - The JWT claims returned by validate_jwt_*. Mutated in place.
• token - The raw access token string (used as Bearer for the userinfo call).
• issuer_url - The OIDC issuer URL (used to derive the userinfo endpoint).
• userinfo_url_override - Optional explicit userinfo URL. If None, the URL is derived from the discovery document’s userinfo_endpoint, falling back to {issuer_url}/userinfo.

Trait Implementations

impl Clone for ResourceServerClient

fn clone(&self) -> ResourceServerClient

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for ResourceServerClient

fn default() -> Self

Returns the “default value” for a type.