Struct AuthorizationServerMetadata

#[non_exhaustive]
pub struct AuthorizationServerMetadata {

    pub issuer: Url,
    pub authorization_endpoint: Url,
    pub token_endpoint: Url,
    pub registration_endpoint: Option<Url>,
    pub response_types_supported: BTreeSet<ResponseType>,
    pub response_modes_supported: BTreeSet<ResponseMode>,
    pub grant_types_supported: BTreeSet<GrantType>,
    pub revocation_endpoint: Url,
    pub code_challenge_methods_supported: BTreeSet<CodeChallengeMethod>,
    pub account_management_uri: Option<Url>,
    pub account_management_actions_supported: BTreeSet<AccountManagementAction>,
    pub device_authorization_endpoint: Option<Url>,
    pub prompt_values_supported: Vec<Prompt>,
}

Available on (crate features client-api-c or client-api-s) and (crate features client or server) and crate feature api and crate feature unstable-msc2965 only.

Metadata describing the configuration of the authorization server.

While the metadata properties and their values are declared for OAuth 2.0 in RFC8414 and other RFCs, this type only supports properties and values that are used for Matrix, as specified in MSC3861 and its dependencies.

This type is validated to have at least all the required values during deserialization. The URLs are not validated during deserialization, to validate them use AuthorizationServerMetadata::validate_urls() or AuthorizationServerMetadata::insecure_validate_urls().

This type has no constructor, it should be sent as raw JSON directly.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

issuer: Url

The authorization server’s issuer identifier.

This should be a URL with no query or fragment components.

authorization_endpoint: Url

URL of the authorization server’s authorization endpoint (RFC6749).

token_endpoint: Url

URL of the authorization server’s token endpoint (RFC6749).

registration_endpoint: Option<Url>

URL of the authorization server’s OAuth 2.0 Dynamic Client Registration endpoint (RFC7591).

response_types_supported: BTreeSet<ResponseType>

List of the OAuth 2.0 response_type values that this authorization server supports.

Those values are the same as those used with the response_types parameter defined by OAuth 2.0 Dynamic Client Registration (RFC7591).

This field must include ResponseType::Code.

response_modes_supported: BTreeSet<ResponseMode>

List of the OAuth 2.0 response_mode values that this authorization server supports.

Those values are specified in OAuth 2.0 Multiple Response Type Encoding Practices.

This field must include ResponseMode::Query and ResponseMode::Fragment.

grant_types_supported: BTreeSet<GrantType>

List of the OAuth 2.0 grant_type values that this authorization server supports.

Those values are the same as those used with the grant_types parameter defined by OAuth 2.0 Dynamic Client Registration (RFC7591).

This field must include GrantType::AuthorizationCode and GrantType::RefreshToken.

revocation_endpoint: Url

URL of the authorization server’s OAuth 2.0 revocation endpoint (RFC7009).

code_challenge_methods_supported: BTreeSet<CodeChallengeMethod>

List of Proof Key for Code Exchange (PKCE) code challenge methods supported by this authorization server (RFC7636).

This field must include CodeChallengeMethod::S256.

account_management_uri: Option<Url>

URL where the user is able to access the account management capabilities of the authorization server (MSC4191).

account_management_actions_supported: BTreeSet<AccountManagementAction>

List of actions that the account management URL supports (MSC4191).

device_authorization_endpoint: Option<Url>

URL of the authorization server’s device authorization endpoint (RFC8628).

prompt_values_supported: Vec<Prompt>

The Prompt values supported by the authorization server (Initiating User Registration via OpenID Connect 1.0).

Implementations

impl AuthorizationServerMetadata

pub fn validate_urls(&self) -> Result<(), AuthorizationServerMetadataUrlError>

Strict validation of the URLs in this AuthorizationServerMetadata.

This checks that:

• The issuer is a valid URL using an https scheme and without a query or fragment.

• All the URLs use an https scheme.

pub fn insecure_validate_urls( &self, ) -> Result<(), AuthorizationServerMetadataUrlError>

Weak validation the URLs AuthorizationServerMetadata are all absolute URLs.

This only checks that the issuer is a valid URL without a query or fragment.

In production, you should prefer AuthorizationServerMetadata that also check if the URLs use an https scheme. This method is meant for development purposes, when interacting with a local authorization server.

Trait Implementations

impl Clone for AuthorizationServerMetadata

fn clone(&self) -> AuthorizationServerMetadata

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthorizationServerMetadata

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuthorizationServerMetadata

fn deserialize<D>( deserializer: D, ) -> Result<AuthorizationServerMetadata, <D as Deserializer<'de>>::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AuthorizationServerMetadata

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.