Struct OidcClient 

pub struct OidcClient { /* private fields */ }

One configured OIDC provider at runtime: config + HTTP client + cached discovery document. The introspection cache lives on the dataplane (OidcIntrospectionCache) so a config reload reuses cached results.

Implementations

impl OidcClient

pub fn build(cfg: OidcProvider) -> Result<Arc<Self>, OidcError>

Build the runtime client from config. The trusted_ca_file is loaded here (at build time) so a broken bundle disables this provider at build instead of failing every request.

pub fn config(&self) -> &OidcProvider

The resolved config (for validation / introspection).

pub fn name(&self) -> &str

The provider’s name (a stable key for the introspection cache).

pub async fn authorization_endpoint(&self) -> Result<String, OidcError>

The authorization endpoint URL (for the auth-code flow): from the discovery document.

pub async fn introspect( &self, token: &str, cache: &OidcIntrospectionCache, ) -> Result<IntrospectionResponse, OidcError>

Introspect a bearer token (RFC 7662). Returns the parsed introspection response. The caller is responsible for caching (via OidcIntrospectionCache) and fail-open/fail-closed mapping. Client auth is HTTP Basic (RFC 7662 section 2.1); the token is sent as token in the form-encoded body.

pub async fn revoke( &self, token: &str, cache: &OidcIntrospectionCache, ) -> Result<(), OidcError>

Revoke a token (RFC 7009). POST to the revocation endpoint with the token. This is an admin/management operation, not on the hot request path. The introspection cache entry for this token is invalidated so the next request re-introspects (or fails 401). Returns Ok(()) on a 2xx response; the RFC notes a 200 is the success response and a 400 may indicate an unrecognized token (treated as an error here so the caller can report it).

pub async fn exchange_token( &self, subject_token: &str, audience: &str, ) -> Result<String, OidcError>

Token exchange (RFC 8693): exchange a subject token for an actor token. The subject token is the client’s bearer token (subject_token); the actor token is what the gateway forwards to the upstream. audience is the resource server the actor token is intended for (RFC 8693 section 2.1). Returns the actor token string on success.

pub async fn exchange_code( &self, code: &str, redirect_uri: &str, code_verifier: &str, ) -> Result<TokenSet, OidcError>

Exchange an authorization code for tokens (RFC 6749 section 4.1, the auth-code + PKCE flow). code is the authorization code from the IdP’s callback redirect; redirect_uri is the gateway’s callback URL; code_verifier is the PKCE verifier matching the challenge sent in the authorization request. Returns the parsed token response (access, refresh, ID token, etc.).

pub async fn authorization_url( &self, redirect_uri: &str, state: &str, code_challenge: &str, ) -> Result<String, OidcError>

Build the authorization request URL for the auth-code + PKCE flow (RFC 6749 section 4.1.1 + RFC 7636). The gateway redirects the user agent to this URL; the IdP authenticates the user and redirects back to redirect_uri with an authorization code. state is an opaque value the gateway round-trips for CSRF protection; code_challenge is the PKCE challenge derived from code_verifier (S256: base64url(sha256(verifier))).

Trait Implementations

impl Debug for OidcClient

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.