Struct EntraIntegration 

pub(crate) struct EntraIntegration {
    http: Client,
    verify_probe: bool,
    login_base: String,
    graph_base: String,
    verify_max_wait: Duration,
    verify_poll_interval: Duration,
}

Microsoft Entra ID integration driver. Each operation fetches a fresh token; secrets never live in self.

Fields

http: Client

verify_probe: bool

Whether verify tries an ROPC sign-in first. Off by default: MFA or Conditional Access blocks ROPC in most tenants.

login_base: String

graph_base: String

verify_max_wait: Duration

verify_poll_interval: Duration

Implementations

impl EntraIntegration

pub(crate) fn new(verify_probe: bool) -> Self

Build a new EntraIntegration using the production Microsoft endpoints.

fn token_url(&self, tenant_id: &str) -> Result<Url, IntegrationError>

Token endpoint URL for tenant_id, built from login_base.

async fn graph_token( &self, creds: &EntraCredentials<'_>, ) -> Result<String, IntegrationError>

Fetch a Graph bearer token by client-credentials grant. The client secret goes only into the form body.

fn graph_user_url( &self, identity: &str, extra_segments: &[&str], ) -> Result<Url, IntegrationError>

Build a Graph user URL with identity as one opaque path segment. push encodes slashes and percent sequences, so attacker-influenced input cannot inject a path.

async fn ropc_probe( &self, creds: &EntraCredentials<'_>, account_identity: &str, new_password: &str, ) -> ProbeResult

Attempt an ROPC grant with the new password, which goes only into the form body and is never stored, logged or returned.

Trait Implementations

impl Debug for EntraIntegration

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Integration for EntraIntegration

fn rotate<'life0, 'life1, 'async_trait>( &'life0 self, ctx: &'life1 RotateContext, ) -> Pin<Box<dyn Future<Output = Result<(), IntegrationError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Reset the password with PATCH /v1.0/users/{identity} and a passwordProfile body. 429 is NotApplied, 5xx is Unknown, other rejections are permanent.

fn verify<'life0, 'life1, 'async_trait>( &'life0 self, ctx: &'life1 RotateContext, ) -> Pin<Box<dyn Future<Output = Result<(), IntegrationError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Verify with the optional ROPC probe first (authoritative, immune to replication lag), then poll up to verify_max_wait for a fresh lastPasswordChangeDateTime. Errors carry Applied.

fn terminate_sessions<'life0, 'life1, 'async_trait>( &'life0 self, ctx: &'life1 RotateContext, ) -> Pin<Box<dyn Future<Output = Result<(), IntegrationError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Revoke sign-in sessions with POST /v1.0/users/{identity}/revokeSignInSessions. Errors carry NotApplied, since termination never changes the credential.