Choose a debugger Protocol Which identity protocol do you want to debug? · Supported Standards
OAuth2 / OIDC Protocol Authorization Code, Implicit, Client Credentials, Resource Owner, Device and Token Exchange grants, all three OIDC flows, plus JWT, JWKS, introspection and userinfo tools. SAML Protocol SAML 2.0 SP-initiated SSO: load IdP metadata, build and sign an AuthnRequest, capture the SAMLResponse at the ACS, and inspect the assertion. WS-Trust Protocol WS-Trust 1.0–1.4 against an STS: build a RequestSecurityToken for Issue, Renew, Validate or Cancel, sign or encrypt it, and inspect the issued token. VC Issuance Issue an SD-JWT VC (RFC 9901) over OID4VCI: wallet-initiated or from an issuer’s Credential Offer, prove possession of a holder key, inspect the disclosures, and refresh it. VC Presentation Present an SD-JWT VC over OID4VP: read the verifier’s DCQL query, choose which Disclosures to send, sign the Key Binding JWT over its nonce, and read the verdict. OIDC Dynamic Client Registration Register a Relying Party at the OP’s registration endpoint, then read, update or delete it with the Registration Access Token. OAuth2 Token Exchange Exchange one token for another (RFC 8693): impersonation or delegation with a subject_token, an optional actor_token and an audience — on the results page after a flow. WS-Federation Protocol WS-Federation Passive Requestor Profile: load federation metadata, build a wa=wsignin1.0 sign-in request, and inspect the SAML token in the wresult. WebAuthn Run a ceremony against a security key, or decode and verify the artifacts of somebody else's: client data, authenticator data, attestation, COSE key. PKI / X.509 Build a Root, Intermediate and Issuing certificate authority, issue certificates with every X.509v3 extension, and make a real TLS or mutual-TLS connection with them. Kerberos Get a TGT from a real KDC and watch both messages, or decode a v5 message, ticket or keytab: every field named, encrypted parts opened when you have the key. Not on the hosted site: Kerberos is DER over port 88, which a browser cannot open and no edge function can catch. Run the debugger locally for it. SPNEGO Kerberos over HTTP (RFC 4559/4178): watch the Negotiate challenge, the token a browser would send, the mechanism list and its MIC, and the ticket inside. Not on the hosted site: the ticket SPNEGO carries comes from a KDC on port 88, which a browser cannot reach. Run the debugger locally for it. LDAP LDAP v3 (RFC 4511) against a real directory: bind, search by filter and scope, create and delete users and groups, change membership, read every result code. Not on the hosted site: LDAP is BER over port 389, which a browser cannot open. Run the debugger locally for it. SCIM SCIM 2.0 (RFC 7644) provisioning: every endpoint by hand, or scenario batches that create, modify and deprovision users and groups and check every step. SPIFFE SPIFFE and SPIRE: fetch an X509-SVID or a JWT-SVID from the Workload API, read the trust bundle, attest an agent, and drive all forty-two SPIRE Server API methods. Not on the hosted site: two of SPIFFE’s three surfaces are gRPC, which a browser cannot produce. Run the debugger locally for it. Shared Signals SSF 1.0 with CAEP and RISC over it: agree a stream, name who it is about, and send or receive Security Event Tokens by push or poll. A workflow greyed out above needs this tool’s API backend, which a hosted static site does not have. To use one, deploy the containerized version — api and client together — from github.com/rcbj/id-proto-debugger .
