Struct matrix_sdk::oidc::types::oidc::ProviderMetadata

pub struct ProviderMetadata {
Show 50 fields
    pub issuer: Option<String>,
    pub authorization_endpoint: Option<Url>,
    pub token_endpoint: Option<Url>,
    pub jwks_uri: Option<Url>,
    pub registration_endpoint: Option<Url>,
    pub scopes_supported: Option<Vec<String>>,
    pub response_types_supported: Option<Vec<ResponseType>>,
    pub response_modes_supported: Option<Vec<ResponseMode>>,
    pub grant_types_supported: Option<Vec<GrantType>>,
    pub token_endpoint_auth_methods_supported: Option<Vec<OAuthClientAuthenticationMethod>>,
    pub token_endpoint_auth_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>,
    pub service_documentation: Option<Url>,
    pub ui_locales_supported: Option<Vec<LanguageTag>>,
    pub op_policy_uri: Option<Url>,
    pub op_tos_uri: Option<Url>,
    pub revocation_endpoint: Option<Url>,
    pub revocation_endpoint_auth_methods_supported: Option<Vec<OAuthClientAuthenticationMethod>>,
    pub revocation_endpoint_auth_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>,
    pub introspection_endpoint: Option<Url>,
    pub introspection_endpoint_auth_methods_supported: Option<Vec<AuthenticationMethodOrAccessTokenType>>,
    pub introspection_endpoint_auth_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>,
    pub code_challenge_methods_supported: Option<Vec<PkceCodeChallengeMethod>>,
    pub userinfo_endpoint: Option<Url>,
    pub acr_values_supported: Option<Vec<String>>,
    pub subject_types_supported: Option<Vec<SubjectType>>,
    pub id_token_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>,
    pub id_token_encryption_alg_values_supported: Option<Vec<JsonWebEncryptionAlg>>,
    pub id_token_encryption_enc_values_supported: Option<Vec<JsonWebEncryptionEnc>>,
    pub userinfo_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>,
    pub userinfo_encryption_alg_values_supported: Option<Vec<JsonWebEncryptionAlg>>,
    pub userinfo_encryption_enc_values_supported: Option<Vec<JsonWebEncryptionEnc>>,
    pub request_object_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>,
    pub request_object_encryption_alg_values_supported: Option<Vec<JsonWebEncryptionAlg>>,
    pub request_object_encryption_enc_values_supported: Option<Vec<JsonWebEncryptionEnc>>,
    pub display_values_supported: Option<Vec<Display>>,
    pub claim_types_supported: Option<Vec<ClaimType>>,
    pub claims_supported: Option<Vec<String>>,
    pub claims_locales_supported: Option<Vec<LanguageTag>>,
    pub claims_parameter_supported: Option<bool>,
    pub request_parameter_supported: Option<bool>,
    pub request_uri_parameter_supported: Option<bool>,
    pub require_request_uri_registration: Option<bool>,
    pub require_signed_request_object: Option<bool>,
    pub pushed_authorization_request_endpoint: Option<Url>,
    pub require_pushed_authorization_requests: Option<bool>,
    pub prompt_values_supported: Option<Vec<Prompt>>,
    pub device_authorization_endpoint: Option<Url>,
    pub end_session_endpoint: Option<Url>,
    pub account_management_uri: Option<Url>,
    pub account_management_actions_supported: Option<Vec<AccountManagementAction>>,

}
Available on crate feature experimental-oidc only.
Expand description

Authorization server metadata, as described by the IANA registry.

All the fields with a default value are accessible via methods.

Fields§

§issuer: Option<String>

Authorization server’s issuer identifier URL.

This field is required. The URL must use a https scheme, and must not contain a query or fragment. It must match the one used to build the well-known URI to query this metadata.

§authorization_endpoint: Option<Url>

URL of the authorization server’s authorization endpoint.

This field is required. The URL must use a https scheme, and must not contain a fragment.

§token_endpoint: Option<Url>

URL of the authorization server’s token endpoint.

This field is required. The URL must use a https scheme, and must not contain a fragment.

§jwks_uri: Option<Url>

URL of the authorization server’s JWK Set document.

This field is required. The URL must use a https scheme.

§registration_endpoint: Option<Url>

URL of the authorization server’s OAuth 2.0 Dynamic Client Registration endpoint.

If this field is present, the URL must use a https scheme.

§scopes_supported: Option<Vec<String>>

JSON array containing a list of the OAuth 2.0 scope values that this authorization server supports.

If this field is present, it must contain at least the openid scope value.

§response_types_supported: Option<Vec<ResponseType>>

JSON array containing a list of the OAuth 2.0 response_type values that this authorization server supports.

This field is required.

§response_modes_supported: Option<Vec<ResponseMode>>

JSON array containing a list of the OAuth 2.0 response_mode values that this authorization server supports.

Defaults to DEFAULT_RESPONSE_MODES_SUPPORTED.

§grant_types_supported: Option<Vec<GrantType>>

JSON array containing a list of the OAuth 2.0 grant_type values that this authorization server supports.

Defaults to DEFAULT_GRANT_TYPES_SUPPORTED.

§token_endpoint_auth_methods_supported: Option<Vec<OAuthClientAuthenticationMethod>>

JSON array containing a list of client authentication methods supported by this token endpoint.

Defaults to DEFAULT_AUTH_METHODS_SUPPORTED.

§token_endpoint_auth_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>

JSON array containing a list of the JWS signing algorithms supported by the token endpoint for the signature on the JWT used to authenticate the client at the token endpoint.

If this field is present, it must not contain JsonWebSignatureAlg::None. This field is required if token_endpoint_auth_methods_supported contains OAuthClientAuthenticationMethod::PrivateKeyJwt or OAuthClientAuthenticationMethod::ClientSecretJwt.

§service_documentation: Option<Url>

URL of a page containing human-readable information that developers might want or need to know when using the authorization server.

§ui_locales_supported: Option<Vec<LanguageTag>>

Languages and scripts supported for the user interface, represented as a JSON array of language tag values from BCP 47.

If omitted, the set of supported languages and scripts is unspecified.

§op_policy_uri: Option<Url>

URL that the authorization server provides to the person registering the client to read about the authorization server’s requirements on how the client can use the data provided by the authorization server.

§op_tos_uri: Option<Url>

URL that the authorization server provides to the person registering the client to read about the authorization server’s terms of service.

§revocation_endpoint: Option<Url>

URL of the authorization server’s OAuth 2.0 revocation endpoint.

If this field is present, the URL must use a https scheme, and must not contain a fragment.

§revocation_endpoint_auth_methods_supported: Option<Vec<OAuthClientAuthenticationMethod>>

JSON array containing a list of client authentication methods supported by this revocation endpoint.

Defaults to DEFAULT_AUTH_METHODS_SUPPORTED.

§revocation_endpoint_auth_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>

JSON array containing a list of the JWS signing algorithms supported by the revocation endpoint for the signature on the JWT used to authenticate the client at the revocation endpoint.

If this field is present, it must not contain JsonWebSignatureAlg::None. This field is required if revocation_endpoint_auth_methods_supported contains OAuthClientAuthenticationMethod::PrivateKeyJwt or OAuthClientAuthenticationMethod::ClientSecretJwt.

§introspection_endpoint: Option<Url>

URL of the authorization server’s OAuth 2.0 introspection endpoint.

If this field is present, the URL must use a https scheme.

§introspection_endpoint_auth_methods_supported: Option<Vec<AuthenticationMethodOrAccessTokenType>>

JSON array containing a list of client authentication methods or token types supported by this introspection endpoint.

§introspection_endpoint_auth_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>

JSON array containing a list of the JWS signing algorithms supported by the introspection endpoint for the signature on the JWT used to authenticate the client at the introspection endpoint.

If this field is present, it must not contain JsonWebSignatureAlg::None. This field is required if intospection_endpoint_auth_methods_supported contains OAuthClientAuthenticationMethod::PrivateKeyJwt or OAuthClientAuthenticationMethod::ClientSecretJwt.

§code_challenge_methods_supported: Option<Vec<PkceCodeChallengeMethod>>

[PKCE code challenge methods] supported by this authorization server. If omitted, the authorization server does not support PKCE.

§userinfo_endpoint: Option<Url>

URL of the OP’s UserInfo Endpoint.

§acr_values_supported: Option<Vec<String>>

JSON array containing a list of the Authentication Context Class References that this OP supports.

§subject_types_supported: Option<Vec<SubjectType>>

JSON array containing a list of the Subject Identifier types that this OP supports.

This field is required.

§id_token_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>

JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token.

This field is required.

§id_token_encryption_alg_values_supported: Option<Vec<JsonWebEncryptionAlg>>

JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token.

§id_token_encryption_enc_values_supported: Option<Vec<JsonWebEncryptionEnc>>

JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token.

§userinfo_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>

JSON array containing a list of the JWS signing algorithms (alg values) supported by the UserInfo Endpoint.

§userinfo_encryption_alg_values_supported: Option<Vec<JsonWebEncryptionAlg>>

JSON array containing a list of the JWE encryption algorithms (alg values) supported by the UserInfo Endpoint.

§userinfo_encryption_enc_values_supported: Option<Vec<JsonWebEncryptionEnc>>

JSON array containing a list of the JWE encryption algorithms (enc values) supported by the UserInfo Endpoint.

§request_object_signing_alg_values_supported: Option<Vec<JsonWebSignatureAlg>>

JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects.

§request_object_encryption_alg_values_supported: Option<Vec<JsonWebEncryptionAlg>>

JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects.

§request_object_encryption_enc_values_supported: Option<Vec<JsonWebEncryptionEnc>>

JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects.

§display_values_supported: Option<Vec<Display>>

JSON array containing a list of the “display” parameter values that the OpenID Provider supports.

§claim_types_supported: Option<Vec<ClaimType>>

JSON array containing a list of the Claim Types that the OpenID Provider supports.

Defaults to DEFAULT_CLAIM_TYPES_SUPPORTED.

§claims_supported: Option<Vec<String>>

JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for.

§claims_locales_supported: Option<Vec<LanguageTag>>

Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP 47 language tag values.

§claims_parameter_supported: Option<bool>

Boolean value specifying whether the OP supports use of the claims parameter.

Defaults to false.

§request_parameter_supported: Option<bool>

Boolean value specifying whether the OP supports use of the request parameter.

Defaults to false.

§request_uri_parameter_supported: Option<bool>

Boolean value specifying whether the OP supports use of the request_uri parameter.

Defaults to true.

§require_request_uri_registration: Option<bool>

Boolean value specifying whether the OP requires any request_uri values used to be pre-registered.

Defaults to false.

§require_signed_request_object: Option<bool>

Indicates where authorization request needs to be protected as Request Object and provided through either request or request_uri parameter.

Defaults to false.

§pushed_authorization_request_endpoint: Option<Url>

URL of the authorization server’s pushed authorization request endpoint.

§require_pushed_authorization_requests: Option<bool>

Indicates whether the authorization server accepts authorization requests only via PAR.

Defaults to false.

§prompt_values_supported: Option<Vec<Prompt>>

Array containing the list of prompt values that this OP supports.

This field can be used to detect if the OP supports the prompt create value.

§device_authorization_endpoint: Option<Url>

URL of the authorization server’s device authorization endpoint.

§end_session_endpoint: Option<Url>

URL of the authorization server’s RP-Initiated Logout endpoint.

§account_management_uri: Option<Url>

URL where the user is able to access the account management capabilities of this OP.

This is a Matrix extension introduced in MSC2965.

§account_management_actions_supported: Option<Vec<AccountManagementAction>>

Array of actions that the account management URL supports.

This is a Matrix extension introduced in MSC2965.

Implementations§

§

impl ProviderMetadata

pub fn validate( self, issuer: &str ) -> Result<VerifiedProviderMetadata, ProviderMetadataVerificationError>

Validate this ProviderMetadata according to the OpenID Connect Discovery Spec 1.0.

§Parameters
  • issuer: The issuer that was discovered to get this ProviderMetadata.
§Errors

Will return Err if validation fails.

pub fn insecure_verify_metadata( self ) -> Result<VerifiedProviderMetadata, ProviderMetadataVerificationError>

Verify this ProviderMetadata.

Contrary to ProviderMetadata::validate(), it only checks that the required fields are present.

This can be used during development to test against a local OpenID Provider, for example.

§Parameters
  • issuer: The issuer that was discovered to get this ProviderMetadata.
§Errors

Will return Err if a required field is missing.

§Warning

It is not recommended to use this method in production as it doesn’t ensure that the issuer implements the proper security practices.

pub fn response_modes_supported(&self) -> &[ResponseMode]

JSON array containing a list of the OAuth 2.0 response_mode values that this authorization server supports.

Defaults to DEFAULT_RESPONSE_MODES_SUPPORTED.

pub fn grant_types_supported(&self) -> &[GrantType]

JSON array containing a list of the OAuth 2.0 grant type values that this authorization server supports.

Defaults to DEFAULT_GRANT_TYPES_SUPPORTED.

pub fn token_endpoint_auth_methods_supported( &self ) -> &[OAuthClientAuthenticationMethod]

JSON array containing a list of client authentication methods supported by the token endpoint.

Defaults to DEFAULT_AUTH_METHODS_SUPPORTED.

pub fn revocation_endpoint_auth_methods_supported( &self ) -> &[OAuthClientAuthenticationMethod]

JSON array containing a list of client authentication methods supported by the revocation endpoint.

Defaults to DEFAULT_AUTH_METHODS_SUPPORTED.

pub fn claim_types_supported(&self) -> &[ClaimType]

JSON array containing a list of the Claim Types that the OpenID Provider supports.

Defaults to DEFAULT_CLAIM_TYPES_SUPPORTED.

pub fn claims_parameter_supported(&self) -> bool

Boolean value specifying whether the OP supports use of the claims parameter.

Defaults to false.

pub fn request_parameter_supported(&self) -> bool

Boolean value specifying whether the OP supports use of the request parameter.

Defaults to false.

pub fn request_uri_parameter_supported(&self) -> bool

Boolean value specifying whether the OP supports use of the request_uri parameter.

Defaults to true.

pub fn require_request_uri_registration(&self) -> bool

Boolean value specifying whether the OP requires any request_uri values used to be pre-registered.

Defaults to false.

pub fn require_signed_request_object(&self) -> bool

Indicates where authorization request needs to be protected as Request Object and provided through either request or request_uri parameter.

Defaults to false.

pub fn require_pushed_authorization_requests(&self) -> bool

Indicates whether the authorization server accepts authorization requests only via PAR.

Defaults to false.

Trait Implementations§

§

impl Clone for ProviderMetadata

§

fn clone(&self) -> ProviderMetadata

Returns a copy of the value. Read more
1.0.0 · source§

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more
§

impl Debug for ProviderMetadata

§

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter. Read more
§

impl Default for ProviderMetadata

§

fn default() -> ProviderMetadata

Returns the “default value” for a type. Read more
§

impl<'de> Deserialize<'de> for ProviderMetadata

§

fn deserialize<__D>( __deserializer: __D ) -> Result<ProviderMetadata, <__D as Deserializer<'de>>::Error>
where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer. Read more
§

impl Serialize for ProviderMetadata

§

fn serialize<__S>( &self, __serializer: __S ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>
where __S: Serializer,

Serialize this value into the given Serde serializer. Read more

Auto Trait Implementations§

Blanket Implementations§

source§

impl<T> Any for T
where T: 'static + ?Sized,

source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
source§

impl<T> Borrow<T> for T
where T: ?Sized,

source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
§

impl<T> CompatExt for T

§

fn compat(self) -> Compat<T>

Applies the [Compat] adapter by value. Read more
§

fn compat_ref(&self) -> Compat<&T>

Applies the [Compat] adapter by shared reference. Read more
§

fn compat_mut(&mut self) -> Compat<&mut T>

Applies the [Compat] adapter by mutable reference. Read more
source§

impl<T> DynClone for T
where T: Clone,

source§

fn __clone_box(&self, _: Private) -> *mut ()

source§

impl<T> From<T> for T

source§

fn from(t: T) -> T

Returns the argument unchanged.

§

impl<T> FromRef<T> for T
where T: Clone,

§

fn from_ref(input: &T) -> T

Converts to this type from a reference to the input type.
§

impl<T> FutureExt for T

§

fn with_context(self, otel_cx: Context) -> WithContext<Self>

Attaches the provided Context to this type, returning a WithContext wrapper. Read more
§

fn with_current_context(self) -> WithContext<Self>

Attaches the current Context to this type, returning a WithContext wrapper. Read more
§

impl<T, UT> HandleAlloc<UT> for T
where T: Send + Sync,

§

fn new_handle(value: Arc<T>) -> Handle

Create a new handle for an Arc value Read more
§

fn clone_handle(handle: Handle) -> Handle

Clone a handle Read more
§

fn consume_handle(handle: Handle) -> Arc<T>

Consume a handle, getting back the initial Arc<>
§

fn get_arc(handle: Handle) -> Arc<Self>

Get a clone of the Arc<> using a “borrowed” handle. Read more
§

impl<T, W> HasTypeWitness<W> for T
where W: MakeTypeWitness<Arg = T>, T: ?Sized,

§

const WITNESS: W = W::MAKE

A constant of the type witness
§

impl<T> Identity for T
where T: ?Sized,

§

type Type = T

The same type as Self, used to emulate type equality bounds (T == U) with associated type equality constraints (T: Identity<Type = U>).
§

const TYPE_EQ: TypeEq<T, <T as Identity>::Type> = TypeEq::NEW

Proof that Self is the same type as Self::Type, provides methods for casting between Self and Self::Type.
source§

impl<T> Instrument for T

source§

fn instrument(self, span: Span) -> Instrumented<Self>

Instruments this type with the provided Span, returning an Instrumented wrapper. Read more
source§

fn in_current_span(self) -> Instrumented<Self>

Instruments this type with the current Span, returning an Instrumented wrapper. Read more
source§

impl<T, U> Into<U> for T
where U: From<T>,

source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

§

impl<T> Pointable for T

§

const ALIGN: usize = _

The alignment of pointer.
§

type Init = T

The type for initializers.
§

unsafe fn init(init: <T as Pointable>::Init) -> usize

Initializes a with the given initializer. Read more
§

unsafe fn deref<'a>(ptr: usize) -> &'a T

Dereferences the given pointer. Read more
§

unsafe fn deref_mut<'a>(ptr: usize) -> &'a mut T

Mutably dereferences the given pointer. Read more
§

unsafe fn drop(ptr: usize)

Drops the object pointed to by the given pointer. Read more
source§

impl<R, P> ReadPrimitive<R> for P
where R: Read + ReadEndian<P>, P: Default,

source§

fn read_from_little_endian(read: &mut R) -> Result<Self, Error>

Read this value from the supplied reader. Same as ReadEndian::read_from_little_endian().
source§

fn read_from_big_endian(read: &mut R) -> Result<Self, Error>

Read this value from the supplied reader. Same as ReadEndian::read_from_big_endian().
source§

fn read_from_native_endian(read: &mut R) -> Result<Self, Error>

Read this value from the supplied reader. Same as ReadEndian::read_from_native_endian().
source§

impl<T> Same for T

§

type Output = T

Should always be Self
source§

impl<T> ToOwned for T
where T: Clone,

§

type Owned = T

The resulting type after obtaining ownership.
source§

fn to_owned(&self) -> T

Creates owned data from borrowed data, usually by cloning. Read more
source§

fn clone_into(&self, target: &mut T)

Uses borrowed data to replace owned data, usually by cloning. Read more
source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

§

type Error = Infallible

The type returned in the event of a conversion error.
source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.
§

impl<V, T> VZip<V> for T
where V: MultiLane<T>,

§

fn vzip(self) -> V

source§

impl<T> WithSubscriber for T

source§

fn with_subscriber<S>(self, subscriber: S) -> WithDispatch<Self>
where S: Into<Dispatch>,

Attaches the provided Subscriber to this type, returning a WithDispatch wrapper. Read more
source§

fn with_current_subscriber(self) -> WithDispatch<Self>

Attaches the current default Subscriber to this type, returning a WithDispatch wrapper. Read more
source§

impl<T> Any for T
where T: Any,

source§

impl<T> AsyncTraitDeps for T
where T: Debug + SendOutsideWasm + SyncOutsideWasm,

source§

impl<T> CloneAny for T
where T: Any + Clone,

source§

impl<T> CloneAnySend for T
where T: Any + Send + Clone,

source§

impl<T> CloneAnySendSync for T
where T: Any + Send + Sync + Clone,

source§

impl<T> CloneAnySync for T
where T: Any + Sync + Clone,

source§

impl<T> DeserializeOwned for T
where T: for<'de> Deserialize<'de>,

source§

impl<T> SendOutsideWasm for T
where T: Send,

source§

impl<T> SyncOutsideWasm for T
where T: Sync,