Struct ClientAssertionVerifier 

pub struct ClientAssertionVerifier {
    started: OffsetDateTime,
    spent: Mutex<SpentKeys>,
}

Checks client assertions, and holds the jti of each one it accepts until the assertion could no longer be accepted anyway.

Fields

started: OffsetDateTime

When this verifier began accepting assertions, to the whole second. For the first window after it, an assertion stamped earlier is refused (ClientAuthError::PredatesStart).

spent: Mutex<SpentKeys>

The jtis spent inside the window, bounded at REPLAY_CAPACITY.

Implementations

impl ClientAssertionVerifier

pub fn new() -> Self

A verifier that begins accepting assertions now.

fn started_at(started: OffsetDateTime) -> Self

ClientAssertionVerifier::new, started at started rather than now, so a test can stamp an assertion on either side of it.

pub fn authenticate( &self, document: &ClientMetadataDocument, credentials: &ClientCredentials, issuer: &str, ) -> Result<Option<ClientAuthKey>, ClientAuthError>

How the client document describes authenticated this request: the key a login it begins is bound to, or None for a public client.

issuer is this server’s own, which an assertion’s aud must name. An assertion that checks out is spent here, so the same one presented again is ClientAuthError::Replayed.

fn authenticate_at( &self, document: &ClientMetadataDocument, credentials: &ClientCredentials, issuer: &str, now: OffsetDateTime, ) -> Result<Option<ClientAuthKey>, ClientAuthError>

fn verify( &self, document: &ClientMetadataDocument, assertion: &str, issuer: &str, now: OffsetDateTime, ) -> Result<ClientAuthKey, ClientAuthError>

Checks assertion against document’s keys: the signature first, so no claim is read before it verifies, then the claims RFC 7523 §3 requires, then the jti.

Trait Implementations

impl Default for ClientAssertionVerifier

fn default() -> Self

Returns the “default value” for a type.