Struct OidcProvider 

pub struct OidcProvider {
    pub name: String,
    pub issuer: String,
    pub client_id: String,
    pub client_secret: String,
    pub trusted_ca_file: Option<String>,
    pub scopes: Vec<String>,
    pub introspection_cache_ttl_s: u64,
    pub introspection_endpoint: Option<String>,
    pub revocation_endpoint: Option<String>,
    pub consumer: Option<String>,
    pub fail_open: bool,
}

One OIDC provider (DW-034): an OpenID Connect issuer whose Bearer tokens are validated by token introspection (RFC 7662) rather than local JWT signature verification. The gateway fetches the issuer’s discovery document ({issuer}/.well-known/openid-configuration) to learn the introspection, revocation, authorization, and token endpoints, then introspects presented Bearer tokens (caching the result keyed by token hash with a configurable TTL). The provider also backs the authorization-code + PKCE relying-party flow, token exchange (RFC 8693), and token revocation (RFC 7009).

Fields

name: String

issuer: String

The OIDC issuer URL (e.g. https://idp.example.com). The discovery document is fetched from {issuer}/.well-known/openid-configuration. Must be an absolute http(s):// URL; validation rejects anything else. The introspection result’s iss (when present) is checked against this issuer for defense against token confusion.

client_id: String

The gateway’s client identifier at the IdP (RFC 6749 section 2.2). Sent as the username of the HTTP Basic auth header to the introspection and token endpoints, and as client_id in the authorization-code and token-exchange request bodies.

client_secret: String

The gateway’s client secret (RFC 6749 section 2.3.1). Either the value INLINE (redacted in every config echo, DW-045) or a ${...} secret reference (env or file) resolved at config-compile time and re-read on every reload. Sent as the password of the HTTP Basic auth header. SECRET: never logged, never in Debug.

trusted_ca_file: Option<String>

Path to a PEM file of CA certificates the OIDC HTTP client trusts for its https:// connections INSTEAD of the default public (webpki) root set: for an IdP served over TLS by a private CA. The file may carry several certificates (a typical CA bundle). Only meaningful with an https:// issuer; validation rejects the combination with an http:// issuer. The file must exist and be readable at config compile time.

scopes: Vec<String>

Scopes to request (default ["openid"]). Sent in the authorization-code flow’s authorization request and the token-exchange request body (space-joined).

introspection_cache_ttl_s: u64

Cache TTL for introspection results, in seconds (default 60). A cached active: true result short-circuits the IdP call for this duration; a cached active: false result is NOT cached (it is re-checked on the next request so a revoked token is noticed promptly). Must be > 0; validation rejects 0.

introspection_endpoint: Option<String>

Override the discovery-discovered introspection endpoint. Absent (the default): the endpoint is taken from the discovery document. Useful when the IdP’s discovery document is incorrect or the endpoint is behind a different host.

revocation_endpoint: Option<String>

Override the discovery-discovered revocation endpoint. Absent (the default): the endpoint is taken from the discovery document.

consumer: Option<String>

Consumer this provider’s tokens authenticate (like JwtProvider::consumer). Absent: the introspection result’s sub claim is used as the consumer name. When set, every successfully introspected token resolves to this consumer regardless of the sub claim.

fail_open: bool

Fail-open posture when the IdP is unreachable (network error, non-2xx, malformed response). Default false (fail closed = 401): the gateway refuses to authenticate a token it cannot introspect. When true, the gateway treats an IdP failure as anonymous (pass-through) rather than rejecting the request. Fail-open trades security for availability; use with care.

Trait Implementations

impl Clone for OidcProvider

fn clone(&self) -> OidcProvider

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OidcProvider

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for OidcProvider

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for OidcProvider

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for OidcProvider

fn eq(&self, other: &OidcProvider) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for OidcProvider

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for OidcProvider