Struct Enrollment 

pub struct Enrollment { /* private fields */ }

Implementations

impl Enrollment

pub fn new(alias: &str, config: OidcConfig) -> Result<Self>

Build an enrollment client for the [oidc.<alias>] entry.

The entry is validated first (the same canonical issuer policy the daemon enforces: https, or http for an exact loopback host), and the HTTP client never follows a redirect: a credential-bearing request is sent to exactly the endpoint that was validated, and a redirect answer is refused rather than forwarded anywhere.

pub async fn device_grant_start(&self) -> Result<DeviceGrantStart>

Start the Device Authorization Grant: returns the user code and verification URI to show the human, plus the polling parameters.

pub async fn device_grant_poll( &self, device_code: &str, ) -> Result<DevicePollOutcome>

One poll of the token endpoint for an in-flight device grant.

pub async fn client_credentials(&self) -> Result<EnrolledToken>

Confidential-client client_credentials grant for headless service principals. Requires the entry’s client_secret.

impl Enrollment

pub async fn pkce_start(&self, redirect_uri: &str) -> Result<PkceFlow>

Begin an Authorization Code + PKCE flow (S256 only): returns the authorize URL to open in a browser plus the client-held secrets for the exchange. Refuses issuers that do not advertise S256 (RFC 8414 defaults the advertisement to plain when the field is absent): there is no downgrade path.

pub async fn pkce_exchange( &self, flow: &PkceFlow, code: &str, ) -> Result<EnrolledToken>

Exchange the authorization code from the callback. When the response bundles an id_token it is validated against this flow (issuer, audience, expiry, nonce) before anything is returned; a present but malformed id_token fails the exchange.