Struct UnsecuredJwsValidator 

pub struct UnsecuredJwsValidator {
    pub principal_claim_name: String,
    pub allowable_clock_skew: Time,
    pub custom_claim_check: Option<JpQuery>,
    pub valid_token_type: Option<String>,
    pub fallback_user_name_claim: Option<String>,
    pub fallback_user_name_prefix: Option<String>,
    pub groups_claim: Option<JpQuery>,
    pub groups_claim_delimiter: Option<String>,
    pub scope_claim_name: String,
    pub required_scope: Vec<String>,
}

Validates an unsecured JWS bearer token (alg: none) and derives the connection principal. Mirrors Kafka’s OAuthBearerUnsecuredValidatorCallbackHandler.

Fields

principal_claim_name: String

Claim whose string value becomes the principal name. Default sub.

allowable_clock_skew: Time

Tolerance applied to the exp / iat temporal checks to absorb clock drift between the client and broker. Default 0, Kafka’s unsecuredValidatorAllowableClockSkewMs.

custom_claim_check: Option<JpQuery>

Precompiled JsonPath expression that the validator evaluates against the token’s claim set. The validator rejects the token when the expression yields empty/null/false. Compile it once at validator construction.

valid_token_type: Option<String>

When set, the JWT typ header field must equal this string. The validator ignores this field when unset.

fallback_user_name_claim: Option<String>

Alternate claim name to read the principal name from when principal_claim_name is absent or empty. Strimzi calls this the “service-account fallback”: sub typically holds a UUID, and client_id is the readable name.

fallback_user_name_prefix: Option<String>

Prepended to the resolved principal name ONLY when the fallback claim fires. Strimzi convention: “service-account-”.

groups_claim: Option<JpQuery>

Precompiled JsonPath expression that extracts group memberships from the token claims. Compile it once at startup.

groups_claim_delimiter: Option<String>

When groups_claim resolves to a string and not an array, split on this delimiter. Common values: “,” or “ “.

scope_claim_name: String

Claim that holds the token’s scope, Kafka’s unsecuredValidatorScopeClaimName. Default scope.

required_scope: Vec<String>

Scope items the token must all carry, Kafka’s unsecuredValidatorRequiredScope. Empty, the default, requires none. parse_required_scope reads the option’s space-delimited value.

Implementations

impl UnsecuredJwsValidator

pub fn validate( &self, token: &str, now_ms: i64, ) -> Result<AuthOutcome, AuthError>

Validate token against now_ms and return the authenticated Principal on success.

now_ms is Unix epoch milliseconds.

Errors

AuthError::InvalidToken for any structural, signature, temporal, scope-claim, or principal-claim failure, and AuthError::InsufficientScope for an otherwise valid token that lacks an item of required_scope. Kafka’s OAuthBearerUnsecuredValidatorCallbackHandler makes the same split. oauth_error_json renders either one as the RFC 7628 server error challenge.

Trait Implementations

impl Clone for UnsecuredJwsValidator

fn clone(&self) -> UnsecuredJwsValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UnsecuredJwsValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for UnsecuredJwsValidator

fn default() -> Self

Returns the “default value” for a type.

impl PartialEq for UnsecuredJwsValidator

fn eq(&self, other: &UnsecuredJwsValidator) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for UnsecuredJwsValidator