Module oidc_auth 

Available on crate feature sso only.

OidcAuth middleware — full OIDC / OAuth 2.0 authorization code flow with PKCE, session management, and claim injection.

Usage

use std::sync::Arc;
use rust_web_server::app::App;
use rust_web_server::core::New;
use rust_web_server::session::SessionStore;
use rust_web_server::sso::{OidcAuth, OidcConfig};

let sessions = Arc::new(SessionStore::new(86400));
let config   = OidcConfig::google("client-id", "client-secret", "https://example.com/auth/callback");
let app      = App::new().wrap(OidcAuth::new(config, sessions));

The middleware intercepts three paths:

• GET /auth/login — generates PKCE + state + nonce, stores them in a pre-auth session, and redirects the user to the identity provider.
• GET /auth/callback — validates state, exchanges the code, verifies the id_token (or fetches UserInfo for GitHub), stores claims in the session, and redirects to the app.
• GET /auth/logout — destroys the session and redirects to /.

On all other paths the middleware checks the session for _oidc_claims. If found, the claims are injected into the request as the X-Rws-Oidc-Claims header (JSON) and the request is passed to the next layer. If not found, the user is redirected to /auth/login.

Use OidcAuth::claims inside a handler to read the injected claims.

Since 18.21.0 (#73):

• OidcAuth::signed_cookies keeps the session in an HMAC-signed cookie instead of the SessionStore, so sessions survive a restart and work across replicas;
• OidcAuth::allow_emails / allow_domains / allow_groups admit only some users (a verified email, its domain, or a group in the ID token);
• OidcAuth::forward_headers sends X-Auth-Request-User, -Email and -Groups upstream (the names oauth2-proxy uses);
• an empty redirect_uri means <scheme>://<Host><callback_path> of the request;
• claim headers a client sends itself are always removed.

Structs

OidcAuth

OIDC / OAuth 2.0 authentication middleware.

SignedIn

A signed-in user (OidcAuth::signed_in).

Constants

CLAIMS_HEADER

Request header name used to pass OIDC claims into downstream handlers.