Struct OidcProvider 

pub struct OidcProvider { /* private fields */ }

One OpenID Connect provider a panel signs users in through, installed with Oidc::provider.

OidcProvider::google is Google. OidcProvider::new is any other provider that publishes a discovery document at {issuer}/.well-known/openid-configuration and returns its ID token from the token endpoint: the panel reads the endpoints from that document on the first sign-in and keeps them.

The panel registers {base_url}{prefix}/sign-in/{key}/callback as its redirect URI, where base_url is Oidc::new’s; register the same URI with the provider.

The panel authenticates to the token endpoint with HTTP Basic (client_secret_basic), which every provider supports. A multi-tenant issuer whose discovery document names a placeholder issuer, such as Microsoft’s common endpoint, fails the discovery check: name the tenant’s own issuer instead.

Implementations

impl OidcProvider

pub fn google( client_id: impl Into<String>, client_secret: impl Into<String>, ) -> Self

Google, signing in the client client_id with client_secret from a Google Cloud project’s OAuth client of the “Web application” type. Its key is google, so its redirect URI is {base_url}{prefix}/sign-in/google/callback.

pub fn new( key: impl Into<String>, label: impl Into<Text>, issuer: impl Into<String>, client_id: impl Into<String>, client_secret: impl Into<String>, ) -> Self

The provider whose issuer is issuer, such as https://login.example.com, signing in the client client_id with client_secret. key names it in its routes, such as okta: lowercase ASCII letters, digits and -. label is the name its button shows.

issuer is an https URL, or an http one on a loopback host for a provider running on the same machine; anything else is a declaration error. It is spelled exactly as the provider’s ID tokens carry it, trailing / included where the provider writes one.

pub fn scope(self, scope: impl Into<String>) -> Self

Also asks for scope, beyond openid email profile.

pub fn param(self, name: impl Into<String>, value: impl Into<String>) -> Self

Sends name=value with every authorization request, such as Google’s .param("prompt", "select_account"), or .param("hd", "example.com") to offer the accounts of one Workspace domain. A parameter only shapes the provider’s page: a linker that admits one domain alone checks the identity’s hd claim itself. Naming a parameter the panel sets, such as state or redirect_uri, is a declaration error.

Trait Implementations

impl Debug for OidcProvider

Redacts the client secret, so a provider logged with ? writes none to the log.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.