Module entra 

Microsoft Entra ID (Azure AD) integration.

Passwords rotate by administrative reset through Microsoft Graph, so the connector never holds the current credential. The Graph token, client secret and new password are never logged.

Structs

EntraCredentials 🔒

The app-registration credentials every Graph call needs, borrowed from the resolved credentials.

EntraIntegration 🔒

Microsoft Entra ID integration driver. Each operation fetches a fresh token; secrets never live in self.

GraphError 🔒

Graph error envelope. error.message is never read, since it can echo user-supplied content.

GraphErrorInner 🔒

TokenResponse 🔒

UserResource 🔒

Enums

ProbeResult 🔒

Result of the ROPC (Resource Owner Password Credentials) verify probe.

Constants

DEFAULT_GRAPH_BASE 🔒

DEFAULT_LOGIN_BASE 🔒

GRAPH_SCOPE 🔒

HTTP_TIMEOUT 🔒

VERIFY_CLOCK_SLACK 🔒

Clock-slack tolerance for the lastPasswordChangeDateTime freshness check.

VERIFY_MAX_WAIT 🔒

How long verify polls Graph for a fresh lastPasswordChangeDateTime.

VERIFY_POLL_INTERVAL 🔒

Functions

get_cred 🔒

Look up a required credential suffix, or fail with credentials_unresolved naming only the suffix.

is_safe_graph_error_code 🔒

Matches ^[A-Za-z0-9_]{1,64}$.

network_error_after_send 🔒

Maps a send error for a mutation. A connect error stays Transient with pre_send_effect; anything else is Unknown, since the mutation may have reached Graph.

network_error_before_send 🔒

Maps a send error for a request with no credential effect; always Transient.

read_graph_error_code 🔒

Read Graph’s error.code from an error body. A code that fails ^[A-Za-z0-9_]{1,64}$ counts as absent, to prevent log injection from attacker-influenced responses.