Struct SignedJwsValidator 

pub struct SignedJwsValidator {
    pub principal_claim_name: String,
    pub allowable_clock_skew: Time,
    pub valid_issuer: Option<String>,
    pub expected_audience: Option<String>,
    pub custom_claim_check: Option<JpQuery>,
    pub valid_token_type: Option<String>,
    pub fallback_user_name_claim: Option<String>,
    pub fallback_user_name_prefix: Option<String>,
    pub groups_claim: Option<JpQuery>,
    pub groups_claim_delimiter: Option<String>,
    pub cache_expiry: Option<Time>,
    /* private fields */
}

Validates a signed JWS bearer token (RS256 / ES256) against a JWKS key set from the identity provider.

The validator then checks the standard JWT claims and derives the connection principal.

The key set lives behind a JwksHandle so the broker’s background refresher can rotate keys without a broker restart and without a lock. Each call to validate reads the current set.

Fields

principal_claim_name: String

Claim whose string value becomes the principal name. Default sub.

allowable_clock_skew: Time

Tolerance applied to exp / iat / nbf.

valid_issuer: Option<String>

When set, the token iss claim must equal this exactly.

expected_audience: Option<String>

When set, the token aud claim must contain this value.

custom_claim_check: Option<JpQuery>

Precompiled JsonPath custom_claim_check. See UnsecuredJwsValidator for semantics.

valid_token_type: Option<String>

JWT typ header check. Ignored when unset.

fallback_user_name_claim: Option<String>

Alternate principal claim. See UnsecuredJwsValidator.

fallback_user_name_prefix: Option<String>

Prepended to the principal name only on fallback.

groups_claim: Option<JpQuery>

Precompiled JsonPath that extracts group memberships.

groups_claim_delimiter: Option<String>

Delimiter when groups_claim resolves to a string.

cache_expiry: Option<Time>

Hard cache-expiry threshold. When set, the validator rejects tokens if the paired refresher has not had a successful fetch within this window. The check reads JwksHandle::last_successful_fetch_ms. None = no expiry check. The validator fails closed on a long IdP outage, so a rotated-out key can’t keep signing valid tokens indefinitely.

Implementations

impl SignedJwsValidator

pub fn new(keys: JwksHandle) -> Self

A validator backed by keys, with the unsecured validator’s claim defaults, Kafka’s 30 s sasl.oauthbearer.clock.skew.seconds, and no issuer / audience constraint.

pub fn key_handle(&self) -> JwksHandle

The shared key-set handle, so the broker can hand the same cell to its JWKS refresher task.

pub fn validate( &self, token: &str, now_ms: i64, ) -> Result<AuthOutcome, AuthError>

Validate a signed bearer token against now_ms.

now_ms is Unix epoch milliseconds.

Errors

AuthError::InvalidToken for any structural, signature, temporal, issuer, audience, scope, or principal-claim failure.

Trait Implementations

impl Clone for SignedJwsValidator

fn clone(&self) -> SignedJwsValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignedJwsValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.