Enum AudienceValidationMode 

#[non_exhaustive]
pub enum AudienceValidationMode {
    Permissive,
    Warn,
    Strict,
}

How the resource server treats azp when validating JWT audience.

Background. RFC 9068 §4 + OIDC Core §2 establish aud as the authoritative resource-server claim and azp as the authorized-party (client) claim. Some OAuth deployments — typically when the MCP server acts as both OAuth client and resource server (the documented OAuthProxyConfig topology) — issue tokens where the configured audience appears only in azp. This enum lets operators decide whether that historic compatibility fallback is honored, surfaced via a one-shot warning, or refused.

Default: AudienceValidationMode::Warn — accepts azp-only matches but emits a tracing::warn! once per process so operators can detect and migrate token-issuing IdP configurations toward populating aud correctly. Future major versions may default to AudienceValidationMode::Strict.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Permissive

Accept aud matches and azp-only matches silently. Pre-1.7 behavior. Use only when the IdP cannot be reconfigured to populate aud.

Warn

Accept aud matches silently. Accept azp-only matches with a one-shot tracing::warn! per process. Reject neither. Default since 1.7.0.

Strict

Accept only aud matches. Reject azp-only matches as audience mismatch. Recommended for new deployments and any IdP that can be configured to populate aud reliably.

Trait Implementations

impl Clone for AudienceValidationMode

fn clone(&self) -> AudienceValidationMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AudienceValidationMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AudienceValidationMode

fn default() -> AudienceValidationMode

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AudienceValidationMode

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for AudienceValidationMode

fn eq(&self, other: &AudienceValidationMode) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for AudienceValidationMode

impl Eq for AudienceValidationMode

impl StructuralPartialEq for AudienceValidationMode