Struct OidcConfig 

pub struct OidcConfig {

    pub issuer: String,
    pub audience: String,
    pub client_id: String,
    pub client_secret: Option<String>,
    pub validation: OidcValidation,
    pub claim_path: String,
    pub profile_map: HashMap<String, String>,
    pub service_profile_map: HashMap<String, String>,
    pub require_mfa: bool,
    pub required_acr: Vec<String>,
    pub allowed_authorized_parties: Vec<String>,
    pub service_clients: Vec<String>,
    pub interactive_clients: Vec<String>,
    pub actor_claim: String,
    pub actor_claim_marks: OidcActorKind,
    pub require_at_jwt: bool,
    pub max_auth_lifetime_secs: u64,
    pub revalidation_secs: u64,
}

One OIDC trust relationship ([oidc.<alias>]): the identity-mapping half consumed by the shared principal resolver, plus the token-verification settings the oidc.<alias> auth provider enforces.

The alias is an operator-chosen handle (it appears in logs and audit attribution as oidc.<alias> and selects the provider during the handshake), never part of principal identity: canonical identity is keyed by the validated issuer plus token subject, so renaming an alias cannot re-key principals or link accounts across issuers.

Fields

issuer: String

Issuer URL exactly as it appears in validated token iss claims (e.g. https://sso.example.com/realms/main). Discovery is fetched from <issuer>/.well-known/openid-configuration and its issuer field must match this value exactly.

audience: String

Audience the token must carry in its aud claim for this daemon (typically the client ID or resource identifier registered at the IdP). Required for token verification.

client_id: String

Client ID this daemon authenticates AS for confidential flows (token introspection; enrollment in a later slice). Defaults to audience when empty.

client_secret: Option<String>

Client secret for confidential-client flows (token introspection). Not required for JWKS validation. Encrypted at rest.

validation: OidcValidation

How presented tokens are validated.

claim_path: String

Dotted path to the verified claim holding this deployment’s role/group values (e.g. realm_access.roles, groups). Must be set explicitly: the daemon refuses to guess where grants live in a token.

profile_map: HashMap<String, String>

Maps a claim value found at claim_path to a [permission_profiles.<alias>] name. Claim values with no mapping grant nothing; an identity mapping to no profile at all is denied.

service_profile_map: HashMap<String, String>

Maps a SERVICE client’s verified client_id to a [permission_profiles.<alias>] name. Service principals resolve ONLY through this map, never profile_map, so a machine credential cannot inherit a human profile from similarly-named claims. A service client_id with no entry here is authenticated but entitled to nothing (fail closed).

require_mfa: bool

Require the token to attest MFA through the IdP aggregate mfa marker or an accepted configured ACR before authentication succeeds.

required_acr: Vec<String>

Acceptable acr (authentication context class) values. Empty = no requirement; non-empty = the token’s acr claim must be one of these values or authentication fails closed.

allowed_authorized_parties: Vec<String>

Allowed azp (authorized party) values, meaning the client the token was issued TO. Empty = no restriction; non-empty = the token must carry an azp claim listed here or authentication fails closed.

service_clients: Vec<String>

Client identities whose tokens are ALWAYS service principals (client_credentials callers), matched against the token’s verified client_id claim. Service principals are keyed by issuer + client identity and never inherit human-user assumptions, whatever provider-specific shape their sub takes (<client>@clients, a service-account user id, or the client id itself).

Actor classification is declarative, never inferred from the sub/client_id relationship: a token is a service because its client is listed here, a human because its client is listed in interactive_clients, or classified by actor_claim. A token whose client is declared nowhere and carries no configured actor claim evidence is denied. A client may appear in only one of the two lists.

interactive_clients: Vec<String>

Client identities whose tokens are ALWAYS human principals (authorization-code / device-code clients), matched against the verified client_id claim. Their tokens must carry a nonblank sub and resolve through profile_map. A client may appear in only one of service_clients and interactive_clients.

actor_claim: String

Dotted path to a claim the issuer stamps on exactly ONE actor kind’s tokens (present, non-null), e.g. Auth0’s gty on client-credentials tokens or Okta’s uid on user tokens. actor_claim_marks names the kind its presence proves; absence proves the other kind. Required for a client that issues both human and machine tokens (declared in neither client list); also checked against declared clients, where contradicting evidence denies. Empty = no claim-based classification, so every accepted client must be declared.

actor_claim_marks: OidcActorKind

Which actor kind the presence of actor_claim proves.

require_at_jwt: bool

Require the RFC 9068 typed JWT profile for JWKS validation. Opaque tokens remain valid only through configured introspection.

max_auth_lifetime_secs: u64

Maximum authentication lifetime (seconds) for offline-validated (JWKS) tokens. Offline validation cannot see revocation, so the identity expires at the EARLIER of the token exp and iat + this cap. Must be > 0.

revalidation_secs: u64

Revalidation interval (seconds) for introspection mode: the deadline stamped on each identity after which the next privileged operation must re-introspect or fail closed. 0 = revalidate at every privileged operation.

Implementations

impl OidcConfig

pub fn configurable_prefix() -> &'static str

Returns the #[prefix] value for this Configurable struct.

pub fn init_requires_explicit_config() -> bool

True when this struct has a required leaf field that a bare/ancestor-prefix init_defaults scaffold must not materialize (it would fill the field with its Rust Default, which prune_empty_leaves then strips on save, leaving a partial sub-table that fails strict reload). Explicitly targeting this section (or a descendant of it) still scaffolds regardless of this flag, so the section can be materialized for the operator to fill in.

pub fn secret_fields(&self) -> Vec<SecretFieldInfo>

Returns metadata about all #[secret] fields on this struct and nested children.

pub fn secret_field_terminals() -> Vec<&'static str>

pub fn encrypt_secrets(&mut self, store: &SecretStore) -> Result<(), Error>

Encrypt all secret fields in place using the provided store.

pub fn decrypt_secrets(&mut self, store: &SecretStore) -> Result<(), Error>

Decrypt all secret fields in place using the provided store.

pub fn set_secret(&mut self, name: &str, value: String) -> Result<(), Error>

Set a secret field by its full dotted name, dispatching to nested children.

pub fn prop_fields(&self) -> Vec<PropFieldInfo>

Returns metadata about all property fields on this struct and nested children.

pub fn get_prop(&self, name: &str) -> Result<String, Error>

Get a property value by its full dotted name, returning it as a display string.

pub fn set_prop(&mut self, name: &str, value_str: &str) -> Result<(), Error>

Set a property value by its full dotted name, parsing from string.

pub fn prop_is_secret(name: &str) -> bool

Check if a property name refers to a secret field (static, no instance needed).

pub fn init_defaults(&mut self, prefix: Option<&str>) -> Vec<&'static str>

Instantiate None nested sections whose prefix matches. Returns the prefixes that were initialized.

pub fn map_key_sections() -> Vec<MapKeySection>

Enumerate every map-keyed (HashMap<String, T>) and list-shaped (Vec<T>) section discoverable from this Configurable’s tree. The dashboard / CLI consume this to surface “+ Add” affordances without hardcoding the section list.

pub fn nested_section_help(name: &str) -> Option<&'static str>

Help blurb for a #[nested] field on this struct, sourced from the field-level /// docstring. Returns None for unknown names so callers can fall through to a different lookup.

pub fn nested_section_group(name: &str) -> Option<&'static str>

pub fn get_map_keys(&self, section_path: &str) -> Option<Vec<String>>

Return the current alias keys at section_path, or None if the path doesn’t resolve to a map-keyed section in this tree.

pub fn nested_option_entries(&self) -> Vec<NestedOptionEntry>

pub fn create_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn delete_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn rename_map_key( &mut self, section_path: &str, map_key: &str, new_key: &str, ) -> Result<bool, String>

impl OidcConfig

pub fn validate(&self, alias: &str) -> Result<(), Error>

pub fn effective_client_id(&self) -> &str

The client ID used for confidential-client calls (introspection); falls back to audience when unset.

Trait Implementations

impl Clone for OidcConfig

fn clone(&self) -> OidcConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OidcConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for OidcConfig

fn default() -> OidcConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OidcConfig

where OidcConfig: Default,

fn deserialize<__D>( __deserializer: __D, ) -> Result<OidcConfig, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for OidcConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl MaskSecrets for OidcConfig

fn mask_secrets(&mut self)

fn restore_secrets_from(&mut self, current: &OidcConfig)

impl Serialize for OidcConfig

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.