Struct IntrospectionValidator 

pub struct IntrospectionValidator {
    pub client: Arc<dyn IntrospectionClient>,
    pub principal_claim_name: String,
    pub custom_claim_check: Option<JpQuery>,
    pub call_userinfo: bool,
    pub allowable_clock_skew: Time,
    pub expected_audience: Option<String>,
    pub fallback_user_name_claim: Option<String>,
    pub fallback_user_name_prefix: Option<String>,
    pub groups_claim: Option<JpQuery>,
    pub groups_claim_delimiter: Option<String>,
}

RFC 7662 opaque-token introspection validator.

The validator calls the introspection endpoint once per token and does no caching. RFC 7662 §4 discourages caching without explicit lifetime info, and SASL runs once per connection, so the cost is acceptable.

After a successful introspection the validator can also call OIDC userinfo and merge the profile claims over the introspection claims.

Fields

client: Arc<dyn IntrospectionClient>

principal_claim_name: String

Claim whose string value becomes the principal name. Default sub for generic OAuth flows; commonly client_id for Keycloak client-credentials.

custom_claim_check: Option<JpQuery>

Precompiled JsonPath custom_claim_check. See UnsecuredJwsValidator for semantics. Introspection has no JWT header, so there is no valid_token_type field here.

call_userinfo: bool

true iff a userinfo_endpoint_uri is configured. The validator then calls client.userinfo(token) after a successful introspection and merges the response over the introspection claims.

allowable_clock_skew: Time

Clock-skew tolerance for exp/iat/nbf checks on introspection-response timestamps, when present.

expected_audience: Option<String>

When set, the introspection-response aud claim (RFC 7662 §2.2) must contain this value. The default is None, which applies no audience restriction. This check stops a token minted for another resource server of the same IdP from authenticating here, even though that token still introspects as active: true.

fallback_user_name_claim: Option<String>

Alternate principal claim. See UnsecuredJwsValidator.

fallback_user_name_prefix: Option<String>

Prepended to the principal name only on fallback.

groups_claim: Option<JpQuery>

Precompiled JsonPath that extracts group memberships from the merged claims, which are the introspection claims plus the optional userinfo claims.

groups_claim_delimiter: Option<String>

Delimiter when groups_claim resolves to a string.

Implementations

impl IntrospectionValidator

pub async fn validate( &self, token: &str, now_ms: i64, ) -> Result<AuthOutcome, AuthError>

Validate a bearer token with RFC 7662 introspection and optional userinfo enrichment.

Errors

• AuthError::IntrospectionTransport on HTTP transport / parse failures.
• AuthError::InvalidToken on active != true, missing exp, missing principal claim, scope mismatch, or temporal-claim failure. exp is required so the SASL handler can populate session_lifetime_ms for KIP-368 re-authentication.

Trait Implementations

impl Clone for IntrospectionValidator

fn clone(&self) -> IntrospectionValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IntrospectionValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.