Struct AuthManager 

pub struct AuthManager { /* private fields */ }

Authentication manager for coordinating multiple authentication providers

MCP Specification Compliance

This manager implements stateless authentication per MCP spec (RFC 9728). No server-side session state is maintained. All authentication decisions are made by validating credentials on EVERY request.

Implementations

impl AuthManager

pub fn new(config: AuthConfig) -> Self

Create a new authentication manager

MCP Specification Compliance

Creates a stateless authentication manager per MCP spec. No server-side session state is maintained.

pub async fn add_provider(&self, provider: Arc<dyn AuthProvider>)

Add an authentication provider

pub async fn remove_provider(&self, name: &str) -> bool

Remove an authentication provider

pub async fn list_providers(&self) -> Vec<String>

List available providers

pub async fn authenticate( &self, provider_name: &str, credentials: AuthCredentials, ) -> McpResult<UnifiedAuthContext>

Authenticate user with credentials

MCP Specification Compliance

Authenticates the user and returns an AuthContext. NO server-side session state is created - per MCP stateless requirement.

The returned AuthContext contains a token (if applicable) that the client must include in subsequent requests via the Authorization header.

Example

let credentials = AuthCredentials::ApiKey {
    key: "secret_key".to_string(),
};

let auth_context = manager.authenticate("api", credentials).await?;

// Extract token for subsequent requests
if let Some(token_info) = &auth_context.token {
    let access_token = &token_info.access_token;
    // Client must send: Authorization: Bearer {access_token}
}

pub async fn validate_token( &self, token: &str, provider_name: Option<&str>, ) -> McpResult<UnifiedAuthContext>

Validate token and get authentication context

MCP Specification Compliance

Validates the token on EVERY request per MCP stateless requirement. This method MUST be called for each incoming request to ensure the token is still valid (not expired, not revoked, etc.).

Arguments

• token - The access token to validate (from Authorization header)
• provider_name - Optional provider name (if known). If None, tries all providers.

Example

// Extract token from Authorization header
let token = auth_header.strip_prefix("Bearer ").unwrap();

// Validate token on EVERY request (stateless)
let auth_context = manager.validate_token(token, None).await?;

// Use auth_context for authorization decisions
println!("Authenticated user: {}", auth_context.user.username);

pub fn check_permission( &self, context: &UnifiedAuthContext, permission: &str, ) -> bool

Check if user has permission

pub fn check_role(&self, context: &UnifiedAuthContext, role: &str) -> bool

Check if user has role

Trait Implementations

impl Debug for AuthManager

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.