Struct Config 

pub struct Config {
    pub issuer: String,
    pub client_id: String,
    pub client_secret: Option<String>,
    pub redirect_uri: String,
    pub scopes: String,
    pub actor_claim: String,
    /* private fields */
}

What an operator states. Everything else is discovered.

Fields

issuer: String

The issuer, as an https URL. It is both what is fetched and what every token’s iss is compared against, which is why there is one field rather than two.

client_id: String

client_secret: Option<String>

None is a public client, which is what a browser-facing app with PKCE is. A confidential client authenticates to the token endpoint with this.

redirect_uri: String

Where the issuer sends the browser back. Registered with the issuer, so it is stated rather than derived from whatever Host a request happened to carry.

scopes: String

The scopes asked for. openid is mandatory and is added if it is missing.

actor_claim: String

Which claim names the actor. sub is the only one an issuer guarantees is stable and unique, which is why it is the default and why choosing another is a decision.

Implementations

impl Config

pub fn new(issuer: &str, client_id: &str, redirect_uri: &str) -> Config

A relying party to somebody else’s identity provider. The issuer must be https.

pub fn in_cluster(issuer: &str, client_id: &str, redirect_uri: &str) -> Config

A relying party to a provider this deployment provisioned, reached inside one namespace.

A second constructor rather than a field, so that the trust story is chosen by name at the one place that knows which of the two this is — identity = managed() in the program, read by beck run. See Config::in_cluster’s field for what it costs.

Trait Implementations

impl Clone for Config

fn clone(&self) -> Config

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Config

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.