Module identity 

OAuth2 client-credentials grant against {identity_url}/connect/token, requesting scope=api.pam.rotation.

Structs

AuthSuccess 🔒

A successful authentication response from the identity server. Debug is hand-written to redact access_token.

IdentityClient 🔒

HTTP client for the POST /connect/token identity endpoint.

Enums

AuthError 🔒

Errors returned by IdentityClient::authenticate.

Constants

REQUEST_TIMEOUT 🔒

SCOPE 🔒

Functions

organization_claim 🔒

Reads the organization claim, which the server emits unprefixed. Its absence is a server contract violation: without an organisation there is no org slot to key.