Struct CertAuthConfig 

pub struct CertAuthConfig {
    pub enabled: bool,
    pub trust_bundle: PathBuf,
    pub identity_mode: CertIdentityMode,
    pub role_oid: Option<String>,
    pub default_role: Role,
    pub map_to_existing_users: bool,
}

Per-deployment cert-auth policy. Enabled on a per-listener basis (the TLS listeners inject this into their accept loop).

Fields

enabled: bool

Whether cert auth is active for this listener. When false the validator is skipped entirely.

trust_bundle: PathBuf

Path to a PEM file containing trusted CA certificates. Client certs must chain to one of these.

identity_mode: CertIdentityMode

Identity extraction mode.

role_oid: Option<String>

Optional X.509 extension OID (dotted notation) that carries the role string. When unset, default_role is used.

default_role: Role

Role assigned when the cert does not carry an explicit role.

map_to_existing_users: bool

When true, a cert whose CN / email matches an existing RedDB user maps to that user (and inherits the user’s stored role). When false, the cert-derived role is always authoritative.

Trait Implementations

impl Clone for CertAuthConfig

fn clone(&self) -> CertAuthConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CertAuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CertAuthConfig

fn default() -> Self

Returns the “default value” for a type.