manta_server/backend_dispatcher/
authentication.rs

1//! [`AuthenticationTrait`] impl for [`StaticBackendDispatcher`].
2//!
3//! Forwards to the per-backend OIDC/Keycloak flow:
4//!
5//! - CSM: token exchange against the site's Keycloak realm (the
6//!   `shasta` client) via csm-rs's `get_api_token`.
7//! - Ochami: token exchange against the ochami-rs configured OIDC
8//!   provider; both methods are implemented on the Ochami side.
9//!
10//! Both branches are real (no `UnsupportedBackend`). The wrapper adds
11//! structured `tracing::debug` on entry and `tracing::warn` on the
12//! error path so an auth failure surfaces backend + user metadata at
13//! the dispatcher boundary.
14
15use super::*;
16
17impl AuthenticationTrait for StaticBackendDispatcher {
18  /// Exchange `username` / `password` for an API bearer token.
19  ///
20  /// # Errors
21  ///
22  /// Returns [`Error::NetError`] / [`Error::RequestError`] when the
23  /// IdP is unreachable, [`Error::CsmError`] / [`Error::BadRequest`]
24  /// on rejection (bad credentials, MFA challenge, locked account),
25  /// and [`Error::Message`] for backend-specific failures.
26  async fn get_api_token(
27    &self,
28    username: &str,
29    password: &str,
30  ) -> Result<String, Error> {
31    let backend = self.backend_kind();
32    tracing::debug!(backend, user = %username, "dispatch: get_api_token");
33    let result = dispatch!(self, get_api_token, username, password);
34    if let Err(ref e) = result {
35      tracing::warn!(
36        backend,
37        user = %username,
38        error = %e,
39        "dispatch: get_api_token returned error from backend client"
40      );
41    }
42    result
43  }
44
45  /// Validate `auth_token` against the IdP / introspection endpoint.
46  ///
47  /// `Ok(())` means the token is currently accepted by the backend;
48  /// no claims are returned through this trait.
49  async fn validate_api_token(&self, auth_token: &str) -> Result<(), Error> {
50    let backend = self.backend_kind();
51    tracing::debug!(backend, "dispatch: validate_api_token");
52    let result = dispatch!(self, validate_api_token, auth_token);
53    if let Err(ref e) = result {
54      tracing::warn!(
55        backend,
56        error = %e,
57        "dispatch: validate_api_token returned error from backend client"
58      );
59    }
60    result
61  }
62}
manta_server/backend_dispatcher/authentication.rs

manta_server/backend_dispatcher/
authentication.rs
