Enum AudienceValidationMode 

#[non_exhaustive]
pub enum AudienceValidationMode {
    Permissive,
    Warn,
    Strict,
}

How the resource server treats azp when validating JWT audience.

Background. RFC 9068 §4 + OIDC Core §2 establish aud as the authoritative resource-server claim and azp as the authorized-party (client) claim. Some OAuth deployments — typically when the MCP server acts as both OAuth client and resource server (the documented OAuthProxyConfig topology) — issue tokens where the configured audience appears only in azp. This enum lets operators decide whether that historic compatibility fallback is honored, surfaced via a one-shot warning, or refused.

Default: AudienceValidationMode::Strict — rejects azp-only matches so a token whose configured audience appears only in azp is refused. To keep the previous azp-accepting behavior, set audience_validation_mode = "warn" (one-shot warning per process) or "permissive" (silent).

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Permissive

Accept aud matches and azp-only matches silently. Pre-1.7 behavior. Use only when the IdP cannot be reconfigured to populate aud.

Warn

Accept aud matches silently. Accept azp-only matches with a one-shot tracing::warn! per process. Reject neither.

Strict

Accept only aud matches. Reject azp-only matches as audience mismatch. Default — recommended for new deployments and any IdP that can be configured to populate aud reliably.

Trait Implementations

impl Clone for AudienceValidationMode

fn clone(&self) -> AudienceValidationMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for AudienceValidationMode

impl Debug for AudienceValidationMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AudienceValidationMode

fn default() -> AudienceValidationMode

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AudienceValidationMode

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for AudienceValidationMode

impl PartialEq for AudienceValidationMode

fn eq(&self, other: &AudienceValidationMode) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for AudienceValidationMode