pub struct NdnIdentity { /* private fields */ }Expand description
A named NDN identity with full lifecycle management.
NdnIdentity extends KeyChain with identity lifecycle operations:
NDNCERT enrollment, fleet provisioning, DID-based trust, and background
certificate renewal.
For the vast majority of applications — signing data and validating
incoming packets — use KeyChain directly (available as
ndn_app::KeyChain or ndn_security::KeyChain). Reach for NdnIdentity
when you need:
Implementations§
Source§impl NdnIdentity
impl NdnIdentity
Sourcepub fn ephemeral(name: impl AsRef<str>) -> Result<Self, IdentityError>
pub fn ephemeral(name: impl AsRef<str>) -> Result<Self, IdentityError>
Create an ephemeral, in-memory, self-signed identity.
Suitable for testing and short-lived producers. Keys are not persisted.
Sourcepub fn open_or_create(
path: &Path,
name: impl AsRef<str>,
) -> Result<Self, IdentityError>
pub fn open_or_create( path: &Path, name: impl AsRef<str>, ) -> Result<Self, IdentityError>
Open a persistent identity from a PIB directory, creating it if absent.
On first run, generates an Ed25519 key and self-signed certificate. On subsequent runs, loads the existing key and certificate.
Sourcepub async fn enroll(config: EnrollConfig) -> Result<Self, IdentityError>
pub async fn enroll(config: EnrollConfig) -> Result<Self, IdentityError>
Enroll via NDNCERT using the given configuration.
Performs the full NDNCERT exchange: INFO → NEW → CHALLENGE. The issued
certificate is persisted if config.storage is set.
Sourcepub async fn provision(config: DeviceConfig) -> Result<Self, IdentityError>
pub async fn provision(config: DeviceConfig) -> Result<Self, IdentityError>
Zero-touch device provisioning.
Selects a challenge type based on FactoryCredential, enrolls with
the CA, and starts a background renewal task if requested.
Sourcepub async fn from_did(
did: &str,
name: impl AsRef<str>,
resolver: &UniversalResolver,
) -> Result<Self, IdentityError>
pub async fn from_did( did: &str, name: impl AsRef<str>, resolver: &UniversalResolver, ) -> Result<Self, IdentityError>
Bootstrap trust from a DID document and create a local ephemeral identity that trusts it.
did:key:…— public key used directly as a trust anchor.did:ndn:…/did:web:…— document resolved viaresolver.
Sourcepub fn into_keychain(self) -> KeyChain
pub fn into_keychain(self) -> KeyChain
Convert this NdnIdentity into the underlying KeyChain.
The renewal task (if any) is dropped and its background task cancelled.
Methods from Deref<Target = KeyChain>§
Sourcepub fn key_name(&self) -> &Name
pub fn key_name(&self) -> &Name
The name of the active signing key (e.g. /com/acme/alice/KEY/v=0).
Sourcepub fn validator(&self) -> Validator
pub fn validator(&self) -> Validator
Build a Validator pre-configured with this identity’s trust anchors.
Uses TrustSchema::accept_all by default (any correctly-signed packet
whose certificate chain terminates in a known anchor is accepted). For
stricter namespace-based policy, call
Validator::set_schema on the result or
use TrustSchema::hierarchical.
Sourcepub fn add_trust_anchor(&self, cert: Certificate)
pub fn add_trust_anchor(&self, cert: Certificate)
Add an external trust anchor certificate.
Use this to accept data signed by a CA that was not issued by this identity (e.g., a network-wide trust anchor discovered via NDNCERT).
Sourcepub fn cert_cache(&self) -> &CertCache
pub fn cert_cache(&self) -> &CertCache
Access the certificate cache.
Useful for pre-populating the cache with known intermediate certificates before validation.
Sourcepub fn sign_data(&self, builder: DataBuilder) -> Result<Bytes, TrustError>
pub fn sign_data(&self, builder: DataBuilder) -> Result<Bytes, TrustError>
Sign a Data packet using this KeyChain’s signing key.
Returns the encoded, signed Data wire bytes. Uses Ed25519 with the key locator set to this identity’s key name.
§Errors
Returns TrustError if the signing key is not available.
Sourcepub fn sign_interest(
&self,
builder: InterestBuilder,
) -> Result<Bytes, TrustError>
pub fn sign_interest( &self, builder: InterestBuilder, ) -> Result<Bytes, TrustError>
Sign an Interest using this KeyChain’s signing key.
Returns the encoded, signed Interest wire bytes. Uses Ed25519 with the key locator set to this identity’s key name.
§Errors
Returns TrustError if the signing key is not available.
Sourcepub fn build_validator(&self) -> Validator
pub fn build_validator(&self) -> Validator
Sourcepub fn manager_arc(&self) -> Arc<SecurityManager>
pub fn manager_arc(&self) -> Arc<SecurityManager>
The Arc-wrapped SecurityManager backing this keychain.
Intended for framework code (e.g., background renewal tasks) that needs to share the manager across async tasks. Prefer the higher-level methods for application code.