Struct Jwks 

pub struct Jwks { /* private fields */ }

A parsed JWK key set.

Lookups are by kid. This module stores a key without a kid under the empty string, and uses that key when a token header omits kid and the set holds exactly one key.

Implementations

impl Jwks

pub fn empty() -> Self

An empty key set. Nothing validates until the broker’s refresher fills it.

pub fn is_empty(&self) -> bool

Whether the key set has no usable keys.

pub fn len(&self) -> usize

Number of usable keys. The count skips unsupported kty / crv.

pub fn from_json(s: &str, ignore_key_use: bool) -> Result<Self, AuthError>

Parse an RFC 7517 JWKS document.

This function skips keys with an unsupported kty / crv / alg. A skipped key is not an error, because identity providers publish encryption keys and other algs next to the signing keys. A document that is not valid JSON, or that has no keys array, is an error.

When ignore_key_use is false, which is the default, this function removes keys with use=enc. Encryption-only keys are unsuitable for signature verification. When ignore_key_use is true, this function keeps all keys regardless of use. Strimzi exposes the same toggle. Some identity providers serve signing keys with use:"enc" by mistake, and operators sometimes need to override.

Errors

AuthError::MalformedMessage when the document is not valid JSON or has no keys array.

pub fn contains_kid(&self, kid: &str) -> bool

Whether this key set holds an entry for kid. Convenience for callers that want to assert on individual keys without exposing the internal map type.

pub fn verify( &self, kid: Option<&str>, alg: &str, signing_input: &[u8], signature: &[u8], ) -> Result<(), AuthError>

Verify a JWS signature over signing_input with the key that kid / alg select.

signing_input is the ASCII header_b64 "." payload_b64.

kid is the token header kid when the header has one. When kid is None, the set must hold exactly one key. alg must be RS256 or ES256 and must match the selected key’s type.

Errors

AuthError::InvalidToken for an unknown / ambiguous key, an alg/key-type mismatch, or a bad signature.

Trait Implementations

impl Clone for Jwks

fn clone(&self) -> Jwks

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Jwks

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Jwks

fn default() -> Jwks

Returns the “default value” for a type.

impl Eq for Jwks

impl PartialEq for Jwks

fn eq(&self, other: &Jwks) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Jwks