Skip to main content
emisar

OIDC and JWKS diagnostics

v0.1.0

Generic read-only OpenID Connect discovery and JWKS diagnostics, plus local key-ID comparison and protected JWT-header inspection. Network actions use explicit HTTPS URLs, never follow redirects, and never submit bearer tokens.

5 allowed by default
Pack ID
oidc-jwks
Vendor
emisar
OS
linux
Actions
5
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
curl jq base64

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install oidc-jwks --hash sha256:fe0d13059d3364ad384fbd16f57b28ce6071361f7fb5da86e440bbfcc96a7295

Actions 5 total

View on GitHub
  • oidc.compare_key_ids script low

    Compare authoritative and consumer key IDs

    Compare two bounded JSON arrays of public key IDs and report missing, extra, and shared IDs. Inputs are sorted and deduplicated before comparison.

    View source on GitHub
  • oidc.discovery script low

    Fetch OIDC discovery metadata

    Fetch and return the public OpenID Provider Configuration for one exact HTTPS issuer. Redirects are rejected and advertised URLs are not followed.

    View source on GitHub
  • oidc.jwks script low

    Fetch a public JWKS

    Fetch and validate one explicit public JWKS. The action rejects redirects, oversized key sets, malformed keys, and private or symmetric key material.

    View source on GitHub
  • oidc.jwt_header script low

    Decode a protected JWT header

    Decode and project recognized fields from a compact JWS or JWE protected header. The payload and claims are never decoded, and no signature or claim validation is performed.

    View source on GitHub
  • oidc.validate_discovery script low

    Validate OIDC discovery metadata

    Require an exact issuer match and an accepted HTTPS jwks_uri in one discovery document. This action does not fetch the advertised JWKS.

    View source on GitHub
← Back to registry
Pack reference Publish your own →