Code in

Quickstart: Rust

Cargo.toml

toml

[dependencies]
openidconnect = "4"
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls"] }

Discover, then build the authorize URL

rust

use openidconnect::core::{CoreClient, CoreProviderMetadata, CoreResponseType};
use openidconnect::{AuthenticationFlow, ClientId, ClientSecret, CsrfToken, IssuerUrl, Nonce, PkceCodeChallenge, RedirectUrl, Scope};

let http = reqwest::ClientBuilder::new().redirect(reqwest::redirect::Policy::none()).build()?;
let metadata = CoreProviderMetadata::discover_async(IssuerUrl::new("https://accounts.aton-network.org".into())?, &http).await?;
let client = CoreClient::from_provider_metadata(metadata, ClientId::new(client_id), Some(ClientSecret::new(secret)))
    .set_redirect_uri(RedirectUrl::new(redirect_uri)?);

let (challenge, verifier) = PkceCodeChallenge::new_random_sha256();
let (url, state, nonce) = client
    .authorize_url(AuthenticationFlow::<CoreResponseType>::AuthorizationCode, CsrfToken::new_random, Nonce::new_random)
    .add_scope(Scope::new("profile".into()))
    .add_scope(Scope::new("email".into()))
    .set_pkce_challenge(challenge)
    .url();

Swap the code and check the ID token

The crate checks the ES256 signature against our published keys, the issuer, the audience, the expiry and the nonce.

On Axum or Actix Web, aton-network-axum and aton-network-actix do all of this for you, with the session, sign-out and webhooks.

rust

let tokens = client.exchange_code(AuthorizationCode::new(code))?
    .set_pkce_verifier(verifier)
    .request_async(&http).await?;
let id_token = tokens.id_token().ok_or("no id token")?;
let claims = id_token.claims(&client.id_token_verifier(), &nonce)?;
let subject = claims.subject().as_str();

Ask Atlas

AI assistant

Ask anything about Sign in with Atheron, the API or the portal. You get an answer from our docs, with links to the pages it used.