Struct AuthContext 

pub struct AuthContext {
    pub subject: String,
    pub scopes: Vec<String>,
    pub claims: HashMap<String, Value>,
    pub token: Option<String>,
    pub client_id: Option<String>,
    pub expires_at: Option<u64>,
    pub authenticated: bool,
}

Available on non-WebAssembly only.

Authentication context containing validated user information.

This is the only auth type your MCP code should interact with. It provides a provider-agnostic view of the authenticated user, regardless of whether the token came from Cognito, Entra, Google, Okta, or any other OIDC provider.

Provider-Agnostic Access

Use the helper methods like email(), tenant_id(), and user_id() instead of directly accessing claims. These methods handle the different claim names used by various OAuth providers.

Example

use pmcp::server::auth::AuthContext;

fn get_user_greeting(auth: &AuthContext) -> String {
    let name = auth.email().unwrap_or(auth.user_id());
    format!("Welcome, {}!", name)
}

Fields

subject: String

Subject identifier (user ID from the sub claim).

scopes: Vec<String>

Granted scopes/permissions.

claims: HashMap<String, Value>

Additional claims from the token. Use the helper methods like email() for common claims.

token: Option<String>

Original token if available (for forwarding to downstream services).

client_id: Option<String>

Client ID that authenticated.

expires_at: Option<u64>

Token expiration timestamp (Unix epoch seconds).

authenticated: bool

Whether this context represents an authenticated user.

Implementations

impl AuthContext

pub fn new(subject: impl Into<String>) -> Self

Create a new authenticated context.

pub fn anonymous() -> Self

Create an anonymous (unauthenticated) context.

pub fn user_id(&self) -> &str

Get the user ID (alias for subject).

This is the standard user identifier, typically from the sub claim.

pub fn claim<T: DeserializeOwned>(&self, key: &str) -> Option<T>

Get a typed claim value.

Example

use pmcp::server::auth::AuthContext;

let auth = AuthContext::new("user-123");
let roles: Option<Vec<String>> = auth.claim("roles");

pub fn email(&self) -> Option<&str>

Get the email address (handles different claim names across providers).

This method checks common claim names used by different OAuth providers:

• email (Cognito, Google, Okta, Auth0)
• preferred_username (Entra ID)
• upn (Entra ID UPN)

pub fn name(&self) -> Option<&str>

Get the display name.

Checks common claim names for user’s name:

• name (most providers)
• given_name + family_name fallback

pub fn tenant_id(&self) -> Option<&str>

Get the tenant ID (handles different claim names across providers).

This method checks common claim names used by different OAuth providers:

• tenant_id (normalized)
• tid (Entra ID)
• custom:tenant_id (Cognito custom attribute)
• custom:tenant (Cognito custom attribute)
• org_id (Auth0, Okta)

pub fn groups(&self) -> Vec<String>

Get groups/roles the user belongs to.

Checks common claim names for group membership:

• groups (Entra ID, Okta)
• cognito:groups (Cognito)
• roles (Auth0)

pub fn has_scope(&self, scope: &str) -> bool

Check if the context has a specific scope.

pub fn has_all_scopes(&self, scopes: &[&str]) -> bool

Check if the context has all specified scopes.

pub fn has_any_scope(&self, scopes: &[&str]) -> bool

Check if the context has any of the specified scopes.

pub fn require_scope(&self, scope: &str) -> Result<(), &'static str>

Require a scope, returning an error message if missing.

Example

use pmcp::server::auth::AuthContext;

fn protected_operation(auth: &AuthContext) -> Result<(), &'static str> {
    auth.require_scope("write:data")?;
    // ... perform operation
    Ok(())
}

pub fn require_auth(&self) -> Result<(), &'static str>

Require authentication, returning an error message if not authenticated.

Example

use pmcp::server::auth::AuthContext;

fn protected_operation(auth: &AuthContext) -> Result<&str, &'static str> {
    auth.require_auth()?;
    Ok(auth.user_id())
}

pub fn is_expired(&self) -> bool

Check if the token is expired.

pub fn in_group(&self, group: &str) -> bool

Check if the user is in a specific group.

Trait Implementations

impl Clone for AuthContext

fn clone(&self) -> AuthContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthContext

fn default() -> AuthContext

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AuthContext

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AuthContext

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.