Struct OidcAuth 

pub struct OidcAuth { /* private fields */ }

Available on crate feature sso only.

OIDC / OAuth 2.0 authentication middleware.

See the module documentation for a usage example.

Implementations

impl OidcAuth

pub fn new(config: OidcConfig, sessions: Arc<SessionStore>) -> OidcAuth

Create a new OidcAuth middleware.

sessions is the session store shared with the application.

pub fn exclude(self, prefix: &str) -> OidcAuth

Exclude a path prefix from authentication checks.

Requests whose path starts with prefix bypass the session check and are passed directly to the next layer. Use this for public paths like /healthz or /public/.

pub fn login_path(self, path: &str) -> OidcAuth

Override the login redirect path (default: "/auth/login").

pub fn callback_path(self, path: &str) -> OidcAuth

Override the callback path (default: "/auth/callback").

pub fn logout_path(self, path: &str) -> OidcAuth

Override the logout path (default: "/auth/logout").

pub fn signed_cookies(self, secret: impl Into<Vec<u8>>) -> OidcAuth

Keep sessions in an HMAC-SHA256-signed cookie (_rws_oidc) instead of the SessionStore: nothing is held in memory, so sessions survive a restart and every replica sharing secret accepts them.

pub fn session_ttl(self, secs: u64) -> OidcAuth

How long a sign-in lasts (default 24 h).

pub fn allow_emails( self, emails: impl IntoIterator<Item = impl Into<String>>, ) -> OidcAuth

Admit users with one of these (verified) email addresses.

pub fn allow_domains( self, domains: impl IntoIterator<Item = impl Into<String>>, ) -> OidcAuth

Admit users whose (verified) email is in one of these domains.

pub fn allow_groups( self, claim: &str, groups: impl IntoIterator<Item = impl Into<String>>, ) -> OidcAuth

Admit users with one of these groups in the ID token’s claim (groups by default; Keycloak, Okta, Azure AD and Authentik send one).

pub fn forward_headers(self, on: bool) -> OidcAuth

Send X-Auth-Request-User (sub), X-Auth-Request-Email and X-Auth-Request-Groups to the next layer.

pub fn signed_in(&self, request: &Request) -> Option<SignedIn>

Who is signed in on request (a valid session cookie), without redirecting: for callers that check identity themselves, like the admin API (18.22.0). Allow-lists are not applied.

pub fn claims(req: &Request) -> Option<OidcClaims>

Read the OIDC claims injected by OidcAuth from a request.

Returns None if the request did not pass through an authenticated OidcAuth layer.

pub fn sub(req: &Request) -> Option<String>

Shortcut: return the sub (subject / user ID) from the injected claims.

pub fn email(req: &Request) -> Option<String>

Shortcut: return the email from the injected claims.

Trait Implementations

impl Middleware for OidcAuth

fn handle( &self, request: &Request, connection: &ConnectionInfo, next: &dyn Application, ) -> Result<Response, String>

fn runs_inline(&self, _request: &Request, _connection: &ConnectionInfo) -> bool

true when this layer’s own work for request never blocks (in-memory state, atomics, short mutexes) — see Application::runs_inline. A WithMiddleware stack runs inline only if every layer and the inner application agree. Default false.

fn is_passthrough( &self, _request: &Request, _connection: &ConnectionInfo, ) -> bool

true when handle would do nothing for request but call next (e.g. a rate limit that isn’t configured). A WithMiddleware stack offers the inner application’s execute_async only if every layer passes the request through. Default false.

fn accepts_streamed_body( &self, _request: &Request, _connection: &ConnectionInfo, ) -> bool

true when this layer never reads request.body, so the inner application may receive it as a stream (Application::streams_body). A layer that inspects the body (CSRF tokens in a form, request signatures, rewriting) must keep the default false: it would see an empty body.

fn answers_streamed_body( &self, _request: &Request, _connection: &ConnectionInfo, ) -> bool

true when this layer answers request itself — it doesn’t call next — and reads its body as a stream (a proxy forwarding it as it arrives). The body is then streamed whatever the layers after it and the application would say. Requires accepts_streamed_body. Since 18.3.0.

fn layer_name(&self) -> &'static str

A short name for this layer, as tools that describe an app list it (Application::middleware_names): by default the type’s name without its module path or generic parameters (CacheLayer). Since 18.28.0.