Struct RustyE2eIdentity 

pub struct RustyE2eIdentity {
    pub sign_alg: JwsAlgorithm,
    pub sign_kp: Pem,
    pub hash_alg: HashAlgorithm,
    pub acme_kp: Pem,
    pub acme_jwk: Jwk,
}

Fields

sign_alg: JwsAlgorithm

sign_kp: Pem

hash_alg: HashAlgorithm

acme_kp: Pem

acme_jwk: Jwk

Implementations

impl RustyE2eIdentity

Enrollment flow.

pub fn try_new( sign_alg: JwsAlgorithm, raw_sign_key: Vec<u8>, ) -> E2eIdentityResult<Self>

Builds an instance holding private key material. This instance has to be used in the whole enrollment process then dropped to clear secret key material.

Parameters

• sign_alg - Signature algorithm (only Ed25519 for now)
• raw_sign_key - Raw signature key as bytes

pub fn acme_directory_response( &self, directory: Json, ) -> E2eIdentityResult<AcmeDirectory>

Parses the response from GET /acme/{provisioner-name}/directory. Use this AcmeDirectory in the next step to fetch the first nonce from the acme server. Use AcmeDirectory::new_nonce.

See RFC 8555 Section 7.1.1

Parameters

• directory - http response body

pub fn acme_new_account_request( &self, directory: &AcmeDirectory, previous_nonce: String, ) -> E2eIdentityResult<Json>

For creating a new acme account. This returns a signed JWS-alike request body to send to POST /acme/{provisioner-name}/new-account.

See RFC 8555 Section 7.3.

Parameters

• directory - you got from Self::acme_directory_response
• previous_nonce - you got from calling HEAD {directory.new_nonce}

pub fn acme_new_account_response( &self, account: Json, ) -> E2eIdentityResult<E2eiAcmeAccount>

Parses the response from POST /acme/{provisioner-name}/new-account.

See RFC 8555 Section 7.3.

Parameters

• account - http response body

pub fn acme_new_order_request( &self, display_name: &str, client_id: &str, handle: &str, expiry: Duration, directory: &AcmeDirectory, account: &E2eiAcmeAccount, previous_nonce: String, ) -> E2eIdentityResult<Json>

Creates a new acme order for the handle (userId + display name) and the clientId.

See RFC 8555 Section 7.4.

Parameters

• display_name - human readable name displayed in the application e.g. Smith, Alice M (QA)
• domain - DNS name of owning backend e.g. example.com
• client_id - client identifier with user b64Url encoded & clientId hex encoded e.g. NDUyMGUyMmY2YjA3NGU3NjkyZjE1NjJjZTAwMmQ2NTQ/6add501bacd1d90e@example.com
• handle - user handle e.g. alice.smith.qa@example.com
• expiry - x509 generated certificate expiry
• directory - you got from Self::acme_directory_response
• account - you got from Self::acme_new_account_response
• previous_nonce - “replay-nonce” response header from POST /acme/{provisioner-name}/new-account

pub fn acme_new_order_response( &self, new_order: Json, ) -> E2eIdentityResult<E2eiNewAcmeOrder>

Parses the response from POST /acme/{provisioner-name}/new-order.

See RFC 8555 Section 7.4.

Parameters

• new_order - http response body

pub fn acme_new_authz_request( &self, url: &Url, account: &E2eiAcmeAccount, previous_nonce: String, ) -> E2eIdentityResult<Json>

Creates a new authorization request.

See RFC 8555 Section 7.5.

Parameters

• url - one of the URL in new order’s authorizations (from Self::acme_new_order_response)
• account - you got from Self::acme_new_account_response
• previous_nonce - “replay-nonce” response header from POST /acme/{provisioner-name}/new-order (or from the previous to this method if you are creating the second authorization)

pub fn acme_new_authz_response( &self, new_authz: Json, ) -> E2eIdentityResult<E2eiAcmeAuthorization>

Parses the response from POST /acme/{provisioner-name}/authz/{authz-id}

You then have to map the challenge from this authorization object. The client_id_challenge will be the one with the client_id_host (you supplied to Self::acme_new_order_request) identifier, the other will be your handle_challenge.

See RFC 8555 Section 7.5.

Parameters

• new_authz - http response body

pub fn new_dpop_token( &self, client_id: &str, display_name: &str, dpop_challenge: &E2eiAcmeChallenge, backend_nonce: String, handle: &str, team: Option<String>, expiry: Duration, ) -> E2eIdentityResult<String>

Generates a new client Dpop JWT token. It demonstrates proof of possession of the nonces (from wire-server & acme server) and will be verified by the acme server when verifying the challenge (in order to deliver a certificate).

Then send it to POST /clients/{id}/access-token on wire-server.

Parameters

• access_token_url - backend endpoint where this token will be sent. Should be this one
• client_id - client identifier with user b64Url encoded & clientId hex encoded e.g. NDUyMGUyMmY2YjA3NGU3NjkyZjE1NjJjZTAwMmQ2NTQ:6add501bacd1d90e@example.com
• dpop_challenge - you found after Self::acme_new_authz_response
• backend_nonce - you get by calling GET /clients/token/nonce on wire-server.
• handle - user handle e.g. alice.smith.qa@example.com See endpoint definition
• expiry - token expiry

pub fn acme_dpop_challenge_request( &self, access_token: String, dpop_challenge: &E2eiAcmeChallenge, account: &E2eiAcmeAccount, previous_nonce: String, ) -> E2eIdentityResult<Json>

Creates a new challenge request.

See RFC 8555 Section 7.5.1.

Parameters

• access_token - returned by wire-server from this endpoint
• dpop_challenge - you found after Self::acme_new_authz_response
• account - you got from Self::acme_new_account_response
• previous_nonce - “replay-nonce” response header from POST /acme/{provisioner-name}/authz/{authz-id}

pub fn acme_oidc_challenge_request( &self, id_token: String, oidc_challenge: &E2eiAcmeChallenge, account: &E2eiAcmeAccount, previous_nonce: String, ) -> E2eIdentityResult<Json>

Creates a new challenge request.

See RFC 8555 Section 7.5.1.

Parameters

• id_token - returned by Identity Provider
• oidc_challenge - you found after Self::acme_new_authz_response
• account - you got from Self::acme_new_account_response
• previous_nonce - “replay-nonce” response header from POST /acme/{provisioner-name}/authz/{authz-id}

pub fn acme_new_challenge_response( &self, challenge: Json, ) -> E2eIdentityResult<()>

Parses the response from POST /acme/{provisioner-name}/challenge/{challenge-id}.

See RFC 8555 Section 7.5.1.

Parameters

• challenge - http response body

pub fn acme_check_order_request( &self, order_url: Url, account: &E2eiAcmeAccount, previous_nonce: String, ) -> E2eIdentityResult<Json>

Verifies that the previous challenge has been completed.

See RFC 8555 Section 7.4.

Parameters

• order_url - “location” header from http response you got from Self::acme_new_order_response
• account - you got from Self::acme_new_account_response
• previous_nonce - “replay-nonce” response header from POST /acme/{provisioner-name}/challenge/{challenge-id}

pub fn acme_check_order_response( &self, order: Json, ) -> E2eIdentityResult<E2eiAcmeOrder>

Parses the response from POST /acme/{provisioner-name}/order/{order-id}.

See RFC 8555 Section 7.4.

Parameters

• order - http response body

pub fn acme_finalize_request( &self, order: &E2eiAcmeOrder, account: &E2eiAcmeAccount, previous_nonce: String, ) -> E2eIdentityResult<Json>

Final step before fetching the certificate.

See RFC 8555 Section 7.4.

Parameters

• domains - domains you want to generate a certificate for e.g. ["wire.com"]
• order - you got from Self::acme_check_order_response
• account - you got from Self::acme_new_account_response
• previous_nonce - “replay-nonce” response header from POST /acme/{provisioner-name}/order/{order-id}

pub fn acme_finalize_response( &self, finalize: Json, ) -> E2eIdentityResult<E2eiAcmeFinalize>

Parses the response from POST /acme/{provisioner-name}/order/{order-id}/finalize.

See RFC 8555 Section 7.4.

Parameters

• finalize - http response body

pub fn acme_x509_certificate_request( &self, finalize: E2eiAcmeFinalize, account: E2eiAcmeAccount, previous_nonce: String, ) -> E2eIdentityResult<Json>

Creates a request for finally fetching the x509 certificate.

See RFC 8555 Section 7.4.2.

Parameters

• domains - domains you want to generate a certificate for e.g. ["wire.com"]
• order - you got from Self::acme_check_order_response
• account - you got from Self::acme_new_account_response
• previous_nonce - “replay-nonce” response header from POST /acme/{provisioner-name}/order/{order-id}

pub fn acme_x509_certificate_response( &self, response: String, order: E2eiAcmeOrder, env: Option<&PkiEnvironment>, ) -> E2eIdentityResult<Vec<Vec<u8>>>

Parses the response from POST /acme/{provisioner-name}/certificate/{certificate-id}.

See RFC 8555 Section 7.4.2

Parameters

• response - http string response body

Trait Implementations

impl Debug for RustyE2eIdentity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for RustyE2eIdentity

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for RustyE2eIdentity

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.