Use a customized awc client to fetch jwks

[tk7r]

I am currently implementing an application using actix-4-jwt-auth that uses a custom certificate CA. actix-4-jwt-auth seems to be using the default client configuration to fetch the issuer info. Do i need to fetch and parse the issuer endpoint myself and extract the jwks or is there a way to customize/inject the awc::Client?

[olger]

Hi,
You have no control over the discovery document ? (.well-known....)
A custom client may not be the most logical but something that allows you to implement the different retrieval calls maybe - or a constructor method that allows you to put in the details yourself.
Like to understand your use case a bit more

[tk7r]

I do have the discovery url available - something like https://sso-server..../.well-known/openid-configuration
it can be retrieved by curl - no problem there.

The situation is that the SSL/TLS certificate of this https-server is not signed by a publicly known certificate authority but the company's own CA. We added the company's root CA's certificate to the system truststore so it is known to all the applications that certificates signed by this root-CA are also valid.

The problem is now that the client you use in your library does not use the system's trust store. so it cannot validate the oidc server's certificate. - There is currently no way to override the awc::default instance you create for retrieving the discovery document with our own awc instance that may have been the customized trust store added for proper validation.

I have found some other projects that do fetch this information by itself because - it seems to me - they also cannot use the default implementation
https://github.com/thomasdarimont/oauth2-oidc-for-rust-developers/tree/main/apps/api-actix

[olger]

Ok, it took a while but understood. Client construction with trusted CA certificates is a very specific setup indeed. It's possible to add a way to create an OIDC instance that allows to add your own client.
Don't know when I will be able to add that, if you are able to add it, I am happy to merge it in,