Enum OidcValidation 

pub enum OidcValidation {
    Jwks,
    Introspection,
}

Token validation strategy for an OIDC trust relationship.

Variants

Jwks

Validate token signatures offline against the issuer’s published JWKS (fetched via discovery, refreshed on key rotation with a bounded cooldown). No per-request IdP round-trip; revocation is bounded by max_auth_lifetime_secs and token expiry.

Introspection

Validate every token online via the issuer’s RFC 7662 introspection endpoint. Live revocation within revalidation_secs; requires client_secret.

Endpoint contract (the daemon fails closed on anything less): an active: true response authenticates only when it also reports token_type: Bearer, an aud containing audience, and a nonblank client_id. The endpoint MUST NOT report refresh tokens, ID tokens, or any other non-access credential as an active Bearer token for this audience: RFC 7662 lets an endpoint introspect refresh tokens and treats the daemon’s token_type_hint=access_token as advisory, so this is the issuer’s obligation. Where the issuer stamps an explicit purpose marker (typ, e.g. Keycloak’s Refresh/ID, or token_use, e.g. Cognito’s id), any value other than an access token is denied.

Trait Implementations

impl Clone for OidcValidation

fn clone(&self) -> OidcValidation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for OidcValidation

impl Debug for OidcValidation

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for OidcValidation

fn default() -> OidcValidation

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OidcValidation

fn deserialize<__D>( __deserializer: __D, ) -> Result<OidcValidation, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for OidcValidation

impl HasPropKind for OidcValidation

const PROP_KIND: PropKind = crate::config::PropKind::Enum

const ALIAS_SOURCE: Option<AliasSource> = None

fn display_secret_terminals() -> Vec<&'static str>

Terminal field names whose values must be redacted when this type is displayed as an object/object-array prop. Most prop kinds have no nested secret surface; Configurable object-array element types can override this by delegating to their generated secret_field_terminals.

impl JsonSchema for OidcValidation

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for OidcValidation

fn eq(&self, other: &OidcValidation) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for OidcValidation

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for OidcValidation