Module auth 

Authentication layer for the Kipuka EST server.

RFC 7030 §3.2.3 defines several client authentication mechanisms for EST:

• mTLS — client presents a certificate during the TLS handshake.
• HTTP Basic (OTP) — username=entity-id, password=one-time password.
• HTTP Negotiate (GSSAPI) — Kerberos/SPNEGO authentication.

Each EST endpoint declares an authentication policy (AuthPolicy) that the EstAuth extractor enforces before the handler runs. Admin routes use a separate authentication mechanism (see super::routes::admin).

Modules

cms_auth

CMS message-level authentication for EST (RFC 8295).

enroll_authz

Enrollment authorization: bind the authenticated requester to the CSR and enforce per-label name-authorization policy (NIAP CA PP FDP_ACF.1).

failure_tracker

Authentication failure tracking and account lockout (NIAP CA PP FIA_AFL.1).

gssapi

GSSAPI/Kerberos authentication for EST endpoints.

mtls

mTLS client certificate authentication for EST endpoints.

name_match

Domain name and identity matching for TLS certificates (RFC 6125).

otp

HTTP Basic authentication with One-Time Password for EST enrollment.

Structs

AuthResult

Result of a successful authentication.

EstAuth

Axum extractor that authenticates EST requests.

OptionalAuth

Axum extractor that allows unauthenticated access.

Enums

AuthMethod

How a client authenticated to the EST server.

AuthPolicy

Authentication policy for an EST endpoint.

Constants

CMC_RA_EKU_OID

OID for the id-kp-cmcRA Extended Key Usage (RFC 6402 section 2.10).