Struct KeycloakClaims 

pub struct KeycloakClaims { /* private fields */ }

Keycloak-specific JWT claims implementing Claims and Ephemeral.

Standard JWT fields are accessible via the Claims trait methods (sub, iat, iss, preferred_username) and the Ephemeral trait (exp_unix, is_expired). Keycloak-specific role checks are available directly on this struct.

use rust_auth_lib::{KeyValidator, KeyValidatorConfig, TokenValidator, keycloak::KeycloakClaims};

let validator = KeyValidator::new(KeyValidatorConfig::from_env()?)?;
let claims = validator.validate::<KeycloakClaims>(token)?;

println!("subject: {}", claims.sub());
println!("expires at unix: {}", claims.exp_unix());
if claims.has_role("operator") { /* authorized */ }

Implementations

impl KeycloakClaims

pub fn has_role(&self, role: &str) -> bool

Returns true if the token carries the given realm-level role.

Realm-level roles apply across all clients in the Keycloak realm and are stored in the realm_access.roles claim. For roles scoped to a specific OAuth2 client, use has_client_role instead.

pub fn has_client_role(&self, client_id: &str, role: &str) -> bool

Returns true if the token carries the given role scoped to a specific OAuth2 client.

pub fn roles(&self) -> &[String]

Returns all realm-level roles carried by this token, or an empty slice if none.

For a single-role membership check, prefer has_role. Use this method when you need to enumerate, log, or forward the full role list.

pub fn client_roles(&self, client_id: &str) -> &[String]

Returns all roles scoped to a specific OAuth2 client, or an empty slice if none.

For a single-role membership check, prefer has_client_role. Use this method when you need to enumerate, log, or forward the full role list for a given client.

Trait Implementations

impl Claims for KeycloakClaims

fn sub(&self) -> &str

The subject of the token (sub claim) — identifies who the token represents, typically a user ID or service account identifier.

fn iat(&self) -> u64

The time the token was issued (iat claim), as seconds since the Unix epoch.

fn iss(&self) -> Option<&str>

The issuer of the token (iss claim), or None if the claim is absent. Used to verify the token came from the expected identity provider.

fn preferred_username(&self) -> Option<&str>

The human-readable username from the preferred_username OIDC claim, or None if the claim is absent. Not present in all token types — machine-to-machine tokens typically omit it.

impl Clone for KeycloakClaims

fn clone(&self) -> KeycloakClaims

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeycloakClaims

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for KeycloakClaims

fn deserialize<__D>( __deserializer: __D, ) -> Result<KeycloakClaims, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Ephemeral for KeycloakClaims

fn exp_unix(&self) -> u64

The token’s expiry time as seconds since the Unix epoch (exp claim).

fn is_expired(&self) -> bool

Returns true if the token has expired.