pub struct Audience(/* private fields */);Expand description
One entry of a token’s aud claim.
Deliberately not a ResourceUri. RFC 9728 §2 requires a protected-
resource identifier to be an absolute URI, and ResourceUri enforces
that, but RFC 7519 §4.1.3 puts no such requirement on aud: it is defined
as a StringOrURI, and an authorization server is entitled to mint any
string it likes. Microsoft Entra’s v2.0 tokens carry the web API’s client ID
— a bare GUID with no scheme at all — which ResourceUri::new refuses.
Modelling aud as ResourceUri therefore loses two things at once. A
policy cannot name a GUID, so there is nowhere to say “this server accepts
this client ID”; and TokenClaims::with_audience_string drops every entry
that does not parse, so such a token arrives with an empty audience and is
refused no matter how the policy is configured. One type that holds the
string fixes both.
Comparison is exact, case-sensitive, and never canonicalised — RFC 7519
§4.1.3 defines aud as case-sensitive strings, and a value that canonicalises
to something else would be a different identifier to the server that minted
it.
Implementations§
Source§impl Audience
impl Audience
Trait Implementations§
impl Eq for Audience
Source§impl From<&ResourceUri> for Audience
impl From<&ResourceUri> for Audience
Source§fn from(value: &ResourceUri) -> Self
fn from(value: &ResourceUri) -> Self
The canonical form, so a resource identifier and the audience a token carries for it compare equal however the token spelled it.