oidc-middleware
OpenID Connect for Axum APIs and browser sessions, configured with
Quarkus-style oidc.* properties. Authentication is a Tower
layer; authorization is attached visibly to routes and fails closed.
Availability
Source code and version tags are on GitHub. The project isn't published on crates.io. Requires Rust 1.88 or later.
Details
Tokens can be validated against a static key, a static or refreshable JWKS, an introspection endpoint, UserInfo or your own validator. JWT checks cover audience, issuer, token type, subject, required claims, age and algorithm, and role mapping understands Keycloak-style resource roles. Multi-tenant setups pick a tenant by request path, header or token issuer.
The web-app feature adds the authorization-code flow
with encrypted state cookies, nonce-bound ID token validation,
refresh and RP-initiated logout. Certificate-bound tokens and JWE are
rejected at startup rather than silently ignored.
This is experimental and hasn't been security audited. Review it, its dependencies and your provider's behaviour before relying on it in production.