OIDC Discovery Auditor
Pricing
Pay per usage
Audit a public OpenID Connect provider's /.well-known/openid-configuration discovery metadata. Check issuer match, required keys, https endpoints, signing algorithms, and PKCE. Returns a score and grade.
Pricing
Pay per usage
Rating
0.0
(0)
Developer
Sanskar Jaiswal
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
a day ago
Last modified
Categories
Share
FROM apify/actor-node:20
COPY package*.json ./RUN npm --quiet set progress=false \ && npm install --omit=dev --omit=optional
COPY . ./
CMD ["npm", "start"]{ "name": "oidc-discovery-auditor", "version": "0.1.0", "description": "Apify Actor that audits a public OpenID Connect provider's /.well-known/openid-configuration discovery metadata against the OIDC Discovery 1.0 spec and returns a score, grade, and recommendations.", "type": "module", "private": true, "main": "src/main.js", "scripts": { "start": "node src/main.js", "test": "node --test test/*.test.js", "lint": "node --check src/main.js" }, "dependencies": { "apify": "^3.4.5" }, "devDependencies": {}}{ "actorSpecification": 1, "name": "oidc-discovery-auditor", "title": "OIDC Discovery Auditor", "description": "Audit a public OpenID Connect provider's /.well-known/openid-configuration discovery metadata in one API call. Validates required keys, issuer match, https endpoints, ID token signing algorithms, and PKCE support. Returns a score, grade, and recommendations.", "version": "0.1", "buildTag": "latest", "meta": { "templateId": "js-start" }, "input": "./input_schema.json", "output": "./output_schema.json", "storages": { "dataset": "./dataset_schema.json" }, "dockerfile": "./Dockerfile", "defaultRunOptions": { "build": "latest", "timeoutSecs": 60, "memoryMbytes": 512 }}{ "actorSpecification": 1, "fields": { "type": "object", "properties": { "inputIssuer": { "type": "string", "description": "The issuer URL provided as input" }, "discoveryUrl": { "type": "string", "description": "The /.well-known/openid-configuration URL that was fetched" }, "finalUrl": { "type": "string", "description": "Final URL after redirects" }, "https": { "type": "boolean", "description": "Whether the discovery document was served over HTTPS" }, "status": { "type": "integer", "description": "Final HTTP status code" }, "documentFound": { "type": "boolean", "description": "Whether a 200 discovery document was served" }, "jsonValid": { "type": "boolean", "description": "Whether the document body is valid JSON" }, "issuer": { "type": "string", "description": "Declared issuer value in the metadata" }, "issuerMatchesFinalUrl": { "type": "boolean", "description": "Whether the declared issuer matches the fetched URL (OIDC clients reject mismatches)" }, "requiredKeys": { "type": "array", "description": "Required metadata keys present" }, "missingRequiredKeys": { "type": "array", "description": "Required metadata keys missing" }, "missingRecommendedKeys": { "type": "array", "description": "Recommended metadata keys missing" }, "metadataKeyCount": { "type": "integer", "description": "Total metadata keys in the document" }, "endpoints": { "type": "array", "description": "Per-endpoint analysis (key, url, https, parseable, issuerHost, issues)" }, "responseTypes": { "type": "array", "description": "response_types_supported values" }, "subjectTypes": { "type": "array", "description": "subject_types_supported values" }, "signingAlgs": { "type": "array", "description": "id_token_signing_alg_values_supported values" }, "codeChallengeMethods": { "type": "array", "description": "code_challenge_methods_supported values (PKCE)" }, "tokenAuthMethods": { "type": "array", "description": "token_endpoint_auth_methods_supported values" }, "scopes": { "type": "array", "description": "scopes_supported values" }, "grantTypes": { "type": "array", "description": "grant_types_supported values" }, "pkceSupported": { "type": "boolean", "description": "Whether PKCE code challenge methods are advertised" }, "checks": { "type": "array", "description": "Per-check analysis objects (name, status, note, weight, recommendation)" }, "issues": { "type": "array", "description": "Aggregated issue descriptions" }, "score": { "type": "integer", "description": "OIDC discovery readiness score (0-100)" }, "grade": { "type": "string", "description": "Letter grade (A+, A, B, C, D, E, F)" }, "checkedAt": { "type": "string", "format": "date-time", "description": "ISO timestamp" }, "recommendations": { "type": "array", "description": "Actionable recommendations for OIDC discovery configuration" } } }, "views": { "overview": { "title": "Overview", "transformation": { "fields": ["discoveryUrl", "https", "status", "documentFound", "jsonValid", "issuer", "issuerMatchesFinalUrl", "pkceSupported", "grade", "score", "issues", "recommendations", "checkedAt"] }, "display": { "component": "table", "properties": { "discoveryUrl": { "label": "Discovery URL", "format": "link" }, "https": { "label": "HTTPS", "format": "boolean" }, "status": { "label": "Status", "format": "number" }, "documentFound": { "label": "Document found", "format": "boolean" }, "jsonValid": { "label": "Valid JSON", "format": "boolean" }, "issuer": { "label": "Issuer", "format": "text" }, "issuerMatchesFinalUrl": { "label": "Issuer match", "format": "boolean" }, "pkceSupported": { "label": "PKCE", "format": "boolean" }, "grade": { "label": "Grade", "format": "text" }, "score": { "label": "Score", "format": "number" }, "issues": { "label": "Issues", "format": "array" }, "recommendations": { "label": "Recommendations", "format": "array" }, "checkedAt": { "label": "Checked", "format": "date" } } } } }}{ "title": "OIDC Discovery Auditor", "type": "object", "schemaVersion": 1, "description": "Audit a public OpenID Connect provider's /.well-known/openid-configuration discovery metadata in one API call. Get required-key validation, issuer match, https endpoint checks, ID token signing algorithm and PKCE validation, a readiness score, grade, and recommendations.", "properties": { "startUrl": { "title": "Issuer URL", "type": "string", "description": "Public issuer identifier of the OpenID Connect provider (issuer root domain, no path). The actor fetches https://<issuer>/.well-known/openid-configuration and audits the metadata. HTTP and HTTPS only. Private IP ranges are blocked.", "editor": "textfield", "prefill": "https://accounts.google.com" }, "timeoutSeconds": { "title": "Request timeout (seconds)", "type": "integer", "description": "Timeout for the HTTP request.", "minimum": 3, "maximum": 30, "default": 10, "unit": "seconds", "editor": "number" } }, "required": ["startUrl"]}{ "actorOutputSchemaVersion": 1, "title": "Output schema of OIDC Discovery Auditor", "description": "Audit results are stored in the default dataset.", "properties": { "results": { "type": "string", "title": "Audit results", "template": "{{links.apiDefaultDatasetUrl}}/items" } }}1import { Actor } from 'apify';2import dns from 'node:dns/promises';3import net from 'node:net';4import { fileURLToPath } from 'node:url';5
6const USER_AGENT = 'OIDCDiscoveryAuditor/0.1 (+https://apify.com)';7const DEFAULT_TIMEOUT_SECONDS = 10;8const MAX_BODY_BYTES = 2 * 1024 * 1024; // 2 MB body cap9
10/* ---------------------------------------------------------------------------11 * SSRF protection — shared pattern used across URL-fetching factory actors.12 * Allows only HTTP/HTTPS, rejects URL credentials, rejects localhost/private13 * IP literals, DNS-resolves hostnames, and rejects DNS that resolves to14 * private IP ranges.15 * ------------------------------------------------------------------------- */16
17function isPrivateIPv4(ip) {18 const parts = ip.split('.').map(Number);19 if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return false;20 const [a, b] = parts;21 return a === 1022 || (a === 172 && b >= 16 && b <= 31)23 || (a === 192 && b === 168)24 || a === 12725 || a === 026 || (a === 169 && b === 254);27}28
29function isPrivateIPv6(ip) {30 const normalized = ip.toLowerCase();31 return normalized === '::1'32 || normalized.startsWith('fc')33 || normalized.startsWith('fd')34 || normalized.startsWith('fe80:');35}36
37export async function normalizeAndValidateUrl(rawUrl) {38 if (!rawUrl || typeof rawUrl !== 'string') throw new Error('issuer URL is required');39 if (/^[a-z][a-z0-9+.-]*:/i.test(rawUrl) && !/^https?:\/\//i.test(rawUrl)) {40 throw new Error('Only HTTP and HTTPS URLs are supported');41 }42
43 const withScheme = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`;44 const url = new URL(withScheme);45 if (!['http:', 'https:'].includes(url.protocol)) throw new Error('Only HTTP and HTTPS URLs are supported');46 if (!url.hostname || url.username || url.password) throw new Error('URL must be public and must not include credentials');47
48 const hostname = url.hostname.replace(/^\[|\]$/g, ''); // WHATWG hostname keeps IPv6 brackets49 const literalType = net.isIP(hostname);50 if (literalType === 4 && isPrivateIPv4(hostname)) throw new Error('Private IPv4 targets are blocked');51 if (literalType === 6 && isPrivateIPv6(hostname)) throw new Error('Private IPv6 targets are blocked');52
53 const records = literalType ? [{ address: hostname, family: literalType }] : await dns.lookup(url.hostname, { all: true });54 for (const record of records) {55 if (record.family === 4 && isPrivateIPv4(record.address)) throw new Error('DNS resolves to a private IPv4 address; blocked for SSRF safety');56 if (record.family === 6 && isPrivateIPv6(record.address)) throw new Error('DNS resolves to a private IPv6 address; blocked for SSRF safety');57 }58 return url;59}60
61/* ---------------------------------------------------------------------------62 * HTTP fetch of a JSON document with manual redirect revalidation (SSRF-safe)63 * and a bounded body read. Endpoint URLs found inside metadata are NEVER64 * fetched; only the discovery document on the provided issuer host is read.65 * ------------------------------------------------------------------------- */66
67async function fetchJson(initialUrl, timeoutSeconds, redirectsRemaining = 3) {68 await normalizeAndValidateUrl(initialUrl.href);69 const controller = new AbortController();70 const timeout = setTimeout(() => controller.abort(), timeoutSeconds * 1000);71 try {72 const response = await fetch(initialUrl, {73 method: 'GET',74 redirect: 'manual',75 signal: controller.signal,76 headers: {77 'user-agent': USER_AGENT,78 accept: 'application/json, application/json;charset=UTF-8, */*;q=0.1',79 },80 });81
82 if ([301, 302, 303, 307, 308].includes(response.status)) {83 if (redirectsRemaining <= 0) throw new Error('Too many redirects');84 const location = response.headers.get('location');85 if (!location) throw new Error('Redirect without Location header');86 const nextUrl = new URL(location, initialUrl.href);87 await normalizeAndValidateUrl(nextUrl.href);88 return fetchJson(nextUrl, timeoutSeconds, redirectsRemaining - 1);89 }90
91 // Bounded read: cap the body so a hostile server cannot exhaust memory.92 let text = '';93 try {94 const buffer = await response.arrayBuffer();95 if (buffer.byteLength > MAX_BODY_BYTES) {96 text = new TextDecoder().decode(buffer.slice(0, MAX_BODY_BYTES));97 } else {98 text = new TextDecoder().decode(buffer);99 }100 } catch {101 text = '';102 }103
104 return {105 ok: response.ok,106 status: response.status,107 finalUrl: response.url || initialUrl.href,108 contentType: response.headers.get('content-type') || '',109 https: (response.url || initialUrl.href).startsWith('https://'),110 body: text,111 error: null,112 };113 } catch (error) {114 return {115 ok: false,116 status: null,117 finalUrl: initialUrl.href,118 contentType: '',119 https: initialUrl.protocol === 'https:',120 body: '',121 error: error.message,122 };123 } finally {124 clearTimeout(timeout);125 }126}127
128/* ---------------------------------------------------------------------------129 * OIDC Discovery metadata analysis (OpenID Connect Discovery 1.0 sections 3130 * and 4; RFC 8414 for well-known URI construction).131 * ------------------------------------------------------------------------- */132
133const REQUIRED_KEYS = ['issuer', 'authorization_endpoint', 'jwks_uri', 'response_types_supported'];134const RECOMMENDED_KEYS = ['token_endpoint', 'id_token_signing_alg_values_supported', 'subject_types_supported'];135const ENDPOINT_KEYS = [136 'authorization_endpoint',137 'token_endpoint',138 'userinfo_endpoint',139 'jwks_uri',140 'registration_endpoint',141 'end_session_endpoint',142 'check_session_iframe',143 'revocation_endpoint',144 'introspection_endpoint',145 'pushed_authorization_request_endpoint',146 'device_authorization_endpoint',147 'backchannel_authentication_endpoint',148];149const SIGNING_ALGS = [150 'RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512',151 'ES256', 'ES256K', 'ES384', 'ES512', 'EdDSA',152 'HS256', 'HS384', 'HS512',153];154
155const URI_TEMPLATES = {156 openid: /.well-known\/openid-configuration$/,157 oauth: /.well-known\/oauth-authorization-server(\/|$)/,158};159
160export function wellKnownUrl(issuerUrlString, type) {161 const u = new URL(issuerUrlString);162 if (u.pathname !== '/' && u.pathname !== '') {163 throw new Error('issuer URL must not contain a path (use the issuer root domain)');164 }165 u.search = '';166 u.hash = '';167 if (type === 'oauth') {168 u.pathname = '/.well-known/oauth-authorization-server';169 } else {170 u.pathname = '/.well-known/openid-configuration';171 }172 return u.href;173}174
175function issuerMatches(issuerValue, finalUrlString) {176 // OIDC Discovery 1.0 section 3: the issuer value MUST be identical to the177 // issuer identifier used to construct the discovery URL, i.e. the discovery178 // document must live at <issuer>/.well-known/openid-configuration.179 try {180 const declared = new URL(issuerValue);181 const fetched = new URL(finalUrlString);182 const basePath = declared.pathname.replace(/\/+$/, '');183 const expectedPath = `${basePath}/.well-known/openid-configuration`;184 return declared.origin === fetched.origin && fetched.pathname === expectedPath;185 } catch {186 return false;187 }188}189
190export function analyzeMetadata(doc, finalUrlString) {191 const issues = [];192 if (doc === null || typeof doc !== 'object' || Array.isArray(doc)) {193 issues.push('Discovery document is not a JSON object.');194 return { valid: false, issuer: null, issuerMatchesFinalUrl: false, requiredKeys: [], issues, missingRequired: REQUIRED_KEYS.slice(), presentKeys: [] };195 }196
197 const keys = Object.keys(doc);198 const missingRequired = REQUIRED_KEYS.filter((k) => !(k in doc));199 for (const k of missingRequired) issues.push(`Missing required metadata key '${k}' (OIDC Discovery 1.0 section 3).`);200
201 const missingRecommended = RECOMMENDED_KEYS.filter((k) => !(k in doc));202 const presentKeys = keys;203
204 let issuer = null;205 let issuerMatchesFinalUrl = false;206 if ('issuer' in doc) {207 issuer = typeof doc.issuer === 'string' ? doc.issuer : null;208 if (!issuer) {209 issues.push("'issuer' must be a string URL.");210 } else {211 try {212 const u = new URL(issuer);213 if (!['http:', 'https:'].includes(u.protocol)) issues.push("'issuer' must be an http or https URL.");214 if (u.hash || u.search) issues.push("'issuer' MUST NOT contain a query or fragment component.");215 } catch {216 issues.push("'issuer' is not a parseable URL.");217 }218 issuerMatchesFinalUrl = issuerMatches(issuer, finalUrlString);219 if (!issuerMatchesFinalUrl) {220 issues.push(`issuer value '${issuer}' does not match the URL the document was fetched from; OIDC clients MUST reject mismatched issuer metadata.`);221 }222 }223 }224
225 // Endpoint fields must be https URLs.226 const endpoints = [];227 const endpointIssues = [];228 for (const key of ENDPOINT_KEYS) {229 if (!(key in doc)) continue;230 const value = doc[key];231 if (typeof value !== 'string') {232 endpointIssues.push(`'${key}' must be a string URL.`);233 endpoints.push({ key, url: String(value), https: false, parseable: false, issuerHost: false, issues: ["'must be a string URL'"] });234 continue;235 }236 const https = /^https:\/\//i.test(value);237 let parseable = true;238 let issuerHost = false;239 const local = [];240 try {241 const eu = new URL(value);242 issuerHost = issuer ? eu.origin === new URL(issuer).origin : false;243 } catch {244 parseable = false;245 local.push(`'${key}' is not a parseable URL.`);246 }247 if (!https) local.push(`'${key}' must use https (OIDC Discovery requires https endpoint URLs).`);248 endpoints.push({ key, url: value, https, parseable, issuerHost, issues: local });249 endpointIssues.push(...local);250 }251
252 // scopes_supported must be an array of strings.253 if ('scopes_supported' in doc && (!Array.isArray(doc.scopes_supported) || !doc.scopes_supported.every((s) => typeof s === 'string'))) {254 issues.push("'scopes_supported' must be an array of strings.");255 }256
257 // *_supported arrays must be non-empty arrays.258 for (const key of ['response_types_supported', 'subject_types_supported', 'id_token_signing_alg_values_supported', 'token_endpoint_auth_methods_supported']) {259 if (key in doc && (!Array.isArray(doc[key]) || doc[key].length === 0)) {260 issues.push(`'${key}' must be a non-empty array.`);261 }262 }263
264 // response_modes_supported, grant_types_supported arrays.265 for (const key of ['response_modes_supported', 'grant_types_supported', 'code_challenge_methods_supported']) {266 if (key in doc && !Array.isArray(doc[key])) {267 issues.push(`'${key}' must be an array.`);268 }269 }270
271 // id_token_signing_alg_values_supported values must be known JWS algs.272 if (Array.isArray(doc.id_token_signing_alg_values_supported)) {273 const unknown = doc.id_token_signing_alg_values_supported.filter((a) => !SIGNING_ALGS.includes(a));274 if (unknown.length) {275 issues.push(`'id_token_signing_alg_values_supported' contains unrecognized algorithms: ${unknown.join(', ')}.`);276 }277 if (doc.id_token_signing_alg_values_supported.includes('none')) {278 issues.push("'id_token_signing_alg_values_supported' includes 'none' (unsigned ID tokens); this is prohibited for ID tokens.");279 }280 }281
282 // subject_types_supported values must be public or pairwise.283 if (Array.isArray(doc.subject_types_supported)) {284 const invalid = doc.subject_types_supported.filter((t) => t !== 'public' && t !== 'pairwise');285 if (invalid.length) {286 issues.push(`'subject_types_supported' contains invalid values (must be 'public' or 'pairwise'): ${invalid.join(', ')}.`);287 }288 }289
290 issues.push(...endpointIssues);291 if (missingRecommended.length) {292 issues.push(`Recommended keys missing: ${missingRecommended.join(', ')} (OIDC Discovery 1.0 section 3).`);293 }294
295 return {296 valid: issues.filter((i) => !/Recommended keys missing/.test(i)).length === 0,297 issuer,298 issuerMatchesFinalUrl,299 requiredKeys: REQUIRED_KEYS.filter((k) => k in doc),300 missingRequired,301 missingRecommended,302 presentKeys,303 endpoints,304 issues,305 };306}307
308/* ---------------------------------------------------------------------------309 * Per-check evaluations. Each returns:310 * { status: 'good'|'warn'|'missing'|'info', note, recommendation? }311 * Scoring: 'info' is a no-op, 'missing'/'warn' count against possible,312 * 'good' earns, 'warn' earns half.313 * ------------------------------------------------------------------------- */314
315function evalDocument({ docFetch }) {316 if (docFetch.error) {317 return { status: 'missing', note: `Discovery document request failed: ${docFetch.error}`, recommendation: 'Verify the issuer domain is reachable over https and serves a discovery document.' };318 }319 if (docFetch.status !== 200) {320 return { status: 'missing', note: `Discovery document returned HTTP ${docFetch.status} instead of 200.`, recommendation: 'Serve the discovery document at /.well-known/openid-configuration with a 200 response.' };321 }322 if (!/application\/json/i.test(docFetch.contentType)) {323 return { status: 'warn', note: `Discovery document Content-Type is '${docFetch.contentType || 'none'}'; application/json is expected.`, recommendation: 'Serve the discovery document with Content-Type: application/json.' };324 }325 return { status: 'good', note: `Discovery document served with HTTP 200 and Content-Type '${docFetch.contentType}'.` };326}327
328function evalJson({ doc }) {329 if (doc === null) {330 return { status: 'missing', note: 'Discovery document is not valid JSON or is empty.', recommendation: 'Serve valid JSON metadata in the discovery document body.' };331 }332 if (typeof doc !== 'object' || Array.isArray(doc)) {333 return { status: 'missing', note: 'Discovery document JSON is not an object.', recommendation: 'Serve a JSON object of provider metadata in the discovery document body.' };334 }335 return { status: 'good', note: `Discovery document is valid JSON with ${Object.keys(doc).length} metadata keys.` };336}337
338function evalRequired({ analysis }) {339 const missing = analysis.missingRequired;340 if (missing.length) {341 return { status: 'missing', note: `Missing required metadata keys: ${missing.join(', ')}.`, recommendation: 'Publish all required OIDC Discovery metadata keys: issuer, authorization_endpoint, jwks_uri, response_types_supported.' };342 }343 return { status: 'good', note: `All required metadata keys present: ${REQUIRED_KEYS.join(', ')}.` };344}345
346function evalIssuer({ analysis, docFetch }) {347 if (!analysis.issuer) {348 return { status: 'missing', note: "No usable 'issuer' value in metadata.", recommendation: "Set 'issuer' to the issuer identifier URL exactly matching the discovery document location." };349 }350 if (!analysis.issuerMatchesFinalUrl) {351 return { status: 'missing', note: `issuer '${analysis.issuer}' does not match the fetched document URL '${docFetch.finalUrl}'. OIDC clients MUST reject metadata whose issuer does not match.`, recommendation: 'Set the issuer value to exactly the https URL the discovery document is published at.' };352 }353 if (!/^https:/i.test(analysis.issuer)) {354 return { status: 'warn', note: `issuer '${analysis.issuer}' does not use https.`, recommendation: 'Use an https issuer identifier.' };355 }356 return { status: 'good', note: `issuer '${analysis.issuer}' matches the discovery document URL.` };357}358
359function evalEndpoints({ analysis }) {360 if (!analysis.endpoints.length) {361 return { status: 'missing', note: 'No endpoint metadata found (authorization_endpoint and jwks_uri are required).', recommendation: 'Publish endpoint URLs in the discovery metadata.' };362 }363 const bad = analysis.endpoints.filter((e) => !e.https || !e.parseable);364 if (bad.length) {365 return { status: 'missing', note: `${bad.length} endpoint metadata value(s) are not parseable https URLs: ${bad.map((e) => e.key).join(', ')}.`, recommendation: 'Publish all endpoint metadata values as absolute https URLs.' };366 }367 const nonIssuer = analysis.endpoints.filter((e) => !e.issuerHost);368 if (nonIssuer.length) {369 return { status: 'warn', note: `${nonIssuer.length} endpoint(s) are hosted off the issuer origin (may be intentional for shared IdP platforms): ${nonIssuer.map((e) => e.key).join(', ')}.` };370 }371 return { status: 'good', note: `${analysis.endpoints.length} endpoint(s) documented, all https and on the issuer origin.` };372}373
374function evalSigningAlgs({ doc, analysis }) {375 const algs = Array.isArray(doc?.id_token_signing_alg_values_supported) ? doc.id_token_signing_alg_values_supported : [];376 if (!algs.length) {377 return { status: 'warn', note: "'id_token_signing_alg_values_supported' is not published; clients default to RS256.", recommendation: "Publish 'id_token_signing_alg_values_supported' explicitly." };378 }379 if (algs.includes('none')) {380 return { status: 'missing', note: "'id_token_signing_alg_values_supported' includes 'none' — unsigned ID tokens are prohibited.", recommendation: "Remove 'none' from supported ID token signing algorithms." };381 }382 return { status: 'good', note: `ID token signing algorithms published: ${algs.join(', ')}.` };383}384
385function evalPkce({ doc }) {386 const methods = Array.isArray(doc?.code_challenge_methods_supported) ? doc.code_challenge_methods_supported : [];387 if (!methods.length) {388 return { status: 'warn', note: 'PKCE is not advertised (no code_challenge_methods_supported). Most modern clients still send PKCE, but explicit support signals current-spec posture.', recommendation: "Publish 'code_challenge_methods_supported': [\"S256\"] (plain is discouraged)." };389 }390 const hasS256 = methods.includes('S256');391 const hasPlain = methods.includes('plain');392 if (!hasS256 && hasPlain) {393 return { status: 'missing', note: "'code_challenge_methods_supported' includes only 'plain', which is discouraged by RFC 7636.", recommendation: 'Support S256 for PKCE code challenge methods.' };394 }395 if (hasPlain) {396 return { status: 'warn', note: `'code_challenge_methods_supported' (${methods.join(', ')}) advertises 'plain' alongside S256; RFC 7636 discourages 'plain'.`, recommendation: "Remove 'plain' from code_challenge_methods_supported and advertise S256 only." };397 }398 if (!hasS256) {399 return { status: 'warn', note: `'code_challenge_methods_supported' (${methods.join(', ')}) does not include S256.`, recommendation: 'Support S256 for PKCE.' };400 }401 return { status: 'good', note: `PKCE advertised with methods: ${methods.join(', ')}.` };402}403
404function evalRecommended({ analysis }) {405 const missing = analysis.missingRecommended;406 if (!missing.length) return { status: 'good', note: 'All recommended metadata keys present.' };407 return { status: 'warn', note: `Recommended metadata keys missing: ${missing.join(', ')}.`, recommendation: 'Publish token_endpoint, id_token_signing_alg_values_supported, and subject_types_supported for full client compatibility.' };408}409
410function evalHttps({ docFetch, issuerHttps }) {411 if (docFetch.error) return { status: 'info', note: 'No response to evaluate.' };412 if (!docFetch.https) {413 return { status: 'missing', note: 'Discovery document was not served over https.', recommendation: 'Serve the discovery document over https.' };414 }415 if (issuerHttps === false) {416 return { status: 'warn', note: 'Discovery document is https but the declared issuer is not.', recommendation: 'Use an https issuer identifier.' };417 }418 return { status: 'good', note: 'Discovery document served over https.' };419}420
421const CHECKS = [422 { name: 'document', title: 'Discovery document', weight: 20, fn: evalDocument },423 { name: 'json', title: 'JSON validity', weight: 10, fn: evalJson },424 { name: 'required-keys', title: 'Required metadata keys', weight: 20, fn: evalRequired },425 { name: 'issuer', title: 'Issuer match', weight: 20, fn: evalIssuer },426 { name: 'endpoints', title: 'Endpoint URLs', weight: 10, fn: evalEndpoints },427 { name: 'signing-algs', title: 'ID token signing algorithms', weight: 5, fn: evalSigningAlgs },428 { name: 'pkce', title: 'PKCE support', weight: 10, fn: evalPkce },429 { name: 'recommended', title: 'Recommended keys', weight: 5, fn: evalRecommended },430];431
432export function buildCheckReports(context) {433 const reports = [];434 let earned = 0;435 let possible = 0;436 for (const check of CHECKS) {437 const evaluation = check.fn(context);438 if (evaluation.status !== 'info') possible += check.weight;439 if (evaluation.status === 'good') earned += check.weight;440 else if (evaluation.status === 'warn') earned += Math.round(check.weight * 0.5);441 reports.push({442 name: check.title,443 check: check.name,444 status: evaluation.status,445 note: evaluation.note,446 weight: check.weight,447 recommendation: evaluation.recommendation || null,448 });449 }450 return { reports, earned, possible };451}452
453export function scoreAudit(earned, possible) {454 if (possible === 0) return 0;455 return Math.min(100, Math.max(0, Math.round((earned / possible) * 100)));456}457
458export function gradeFromScore(score) {459 if (score >= 95) return 'A+';460 if (score >= 85) return 'A';461 if (score >= 75) return 'B';462 if (score >= 65) return 'C';463 if (score >= 50) return 'D';464 if (score >= 30) return 'E';465 return 'F';466}467
468export function buildRecommendations(reports) {469 const recs = [];470 for (const r of reports) {471 if (r.recommendation && !recs.includes(r.recommendation)) recs.push(r.recommendation);472 }473 if (recs.length === 0) {474 recs.push('Discovery metadata looks spec-conformant. Re-run this audit after IdP upgrades or domain changes to catch regressions.');475 }476 return recs;477}478
479/* ---------------------------------------------------------------------------480 * Main audit pipeline.481 * ------------------------------------------------------------------------- */482
483export async function auditOidcDiscovery(input) {484 const issuerRaw = input.startUrl || input.issuer;485 const timeoutSeconds = Math.min(Math.max(Number(input.timeoutSeconds || DEFAULT_TIMEOUT_SECONDS), 3), 30);486
487 const issuerUrl = await normalizeAndValidateUrl(issuerRaw);488 const discoveryUrl = wellKnownUrl(issuerUrl.href, 'openid');489 const docFetch = await fetchJson(new URL(discoveryUrl), timeoutSeconds);490
491 let doc = null;492 let parseError = null;493 if (docFetch.body) {494 try {495 doc = JSON.parse(docFetch.body);496 } catch (err) {497 parseError = err.message;498 }499 }500
501 const analysis = doc && typeof doc === 'object' && !Array.isArray(doc)502 ? analyzeMetadata(doc, docFetch.finalUrl)503 : {504 valid: false,505 issuer: null,506 issuerMatchesFinalUrl: false,507 requiredKeys: [],508 missingRequired: REQUIRED_KEYS.slice(),509 missingRecommended: RECOMMENDED_KEYS.slice(),510 presentKeys: [],511 endpoints: [],512 issues: [docFetch.error ? `Request failed: ${docFetch.error}` : parseError ? 'Discovery document is not valid JSON.' : 'Discovery document is empty or not a JSON object.'],513 };514
515 const issuerHttps = typeof analysis.issuer === 'string' ? analysis.issuer.startsWith('https://') : null;516 const context = { docFetch, doc, analysis, issuerHttps };517 const { reports, earned, possible } = buildCheckReports(context);518 const score = scoreAudit(earned, possible);519 const grade = gradeFromScore(score);520 const recommendations = buildRecommendations(reports);521
522 const issues = reports523 .filter((r) => r.status === 'warn' || r.status === 'missing')524 .map((r) => `${r.name}: ${r.note}`);525
526 const grantTypes = Array.isArray(doc?.grant_types_supported) ? doc.grant_types_supported : null;527 const scopes = Array.isArray(doc?.scopes_supported) ? doc.scopes_supported : null;528 const signingAlgs = Array.isArray(doc?.id_token_signing_alg_values_supported) ? doc.id_token_signing_alg_values_supported : null;529 const codeChallengeMethods = Array.isArray(doc?.code_challenge_methods_supported) ? doc.code_challenge_methods_supported : null;530 const tokenAuthMethods = Array.isArray(doc?.token_endpoint_auth_methods_supported) ? doc.token_endpoint_auth_methods_supported : null;531 const subjectTypes = Array.isArray(doc?.subject_types_supported) ? doc.subject_types_supported : null;532 const responseTypes = Array.isArray(doc?.response_types_supported) ? doc.response_types_supported : null;533
534 return {535 inputIssuer: issuerRaw,536 discoveryUrl,537 finalUrl: docFetch.finalUrl,538 https: docFetch.https,539 status: docFetch.status,540 contentType: docFetch.contentType || null,541 documentFound: docFetch.ok && docFetch.status === 200,542 jsonValid: doc !== null,543 parseError,544 issuer: analysis.issuer,545 issuerMatchesFinalUrl: analysis.issuerMatchesFinalUrl,546 requiredKeys: analysis.requiredKeys,547 missingRequiredKeys: analysis.missingRequired,548 missingRecommendedKeys: analysis.missingRecommended,549 metadataKeyCount: analysis.presentKeys.length,550 endpoints: analysis.endpoints.map(({ key, url, https, parseable, issuerHost, issues: ei }) => ({ key, url, https, parseable, issuerHost, issues: ei })),551 responseTypes,552 subjectTypes,553 signingAlgs,554 codeChallengeMethods,555 tokenAuthMethods,556 scopes,557 grantTypes,558 pkceSupported: Array.isArray(codeChallengeMethods) && codeChallengeMethods.length > 0,559 checks: reports,560 issues,561 score,562 grade,563 checkedAt: new Date().toISOString(),564 recommendations,565 error: docFetch.error,566 };567}568
569/* ---------------------------------------------------------------------------570 * Apify runtime entry point.571 * ------------------------------------------------------------------------- */572
573const isExecutedDirectly = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1];574
575if (process.env.NODE_ENV !== 'test' && isExecutedDirectly) {576 await Actor.init();577 try {578 const input = await Actor.getInput();579 const result = await auditOidcDiscovery(input || {});580 await Actor.pushData(result);581 await Actor.setValue('OUTPUT', result);582 Actor.log.info('OIDC discovery audit complete', { discoveryUrl: result.discoveryUrl, score: result.score, grade: result.grade });583 } finally {584 await Actor.exit();585 }586}1import test from 'node:test';2import assert from 'node:assert/strict';3import {4 analyzeMetadata,5 buildCheckReports,6 buildRecommendations,7 gradeFromScore,8 normalizeAndValidateUrl,9 scoreAudit,10 wellKnownUrl,11} from '../src/main.js';12
13/* ---------------------------------------------------------------------------14 * SSRF / URL validation security tests15 * ------------------------------------------------------------------------- */16
17test('normalizeAndValidateUrl blocks private IPv4 literal', async () => {18 await assert.rejects(() => normalizeAndValidateUrl('http://127.0.0.1/'), /Private IPv4/);19});20
21test('normalizeAndValidateUrl blocks 169.254 link-local', async () => {22 await assert.rejects(() => normalizeAndValidateUrl('http://169.254.169.254/'), /Private IPv4/);23});24
25test('normalizeAndValidateUrl blocks private IPv6 literal', async () => {26 await assert.rejects(() => normalizeAndValidateUrl('http://[fd12::1]/'), /Private IPv6/);27});28
29test('normalizeAndValidateUrl rejects URL credentials', async () => {30 await assert.rejects(() => normalizeAndValidateUrl('https://user:pass@example.com'), /credentials/);31});32
33test('normalizeAndValidateUrl rejects non-HTTP schemes', async () => {34 await assert.rejects(() => normalizeAndValidateUrl('file:///etc/hosts'), /HTTP and HTTPS/);35});36
37test('normalizeAndValidateUrl rejects ftp scheme', async () => {38 await assert.rejects(() => normalizeAndValidateUrl('ftp://example.com/file'), /HTTP and HTTPS/);39});40
41test('normalizeAndValidateUrl accepts public hostname and defaults to https', async () => {42 const url = await normalizeAndValidateUrl('example.com');43 assert.equal(url.hostname, 'example.com');44 assert.equal(url.protocol, 'https:');45});46
47/* ---------------------------------------------------------------------------48 * Discovery URL construction (RFC 8414 / OIDC Discovery 1.0)49 * ------------------------------------------------------------------------- */50
51test('wellKnownUrl builds openid-configuration URL from issuer root', () => {52 assert.equal(53 wellKnownUrl('https://accounts.example.com/', 'openid'),54 'https://accounts.example.com/.well-known/openid-configuration',55 );56});57
58test('wellKnownUrl strips query and fragment from issuer', () => {59 assert.equal(60 wellKnownUrl('https://accounts.example.com/?x=1#frag', 'openid'),61 'https://accounts.example.com/.well-known/openid-configuration',62 );63});64
65test('wellKnownUrl rejects issuer with a path', () => {66 assert.throws(() => wellKnownUrl('https://example.com/tenant1', 'openid'), /path/);67});68
69/* ---------------------------------------------------------------------------70 * Metadata analysis71 * ------------------------------------------------------------------------- */72
73const GOOD_DOC = {74 issuer: 'https://accounts.example.com',75 authorization_endpoint: 'https://accounts.example.com/o/auth',76 token_endpoint: 'https://accounts.example.com/o/token',77 jwks_uri: 'https://accounts.example.com/.well-known/jwks.json',78 userinfo_endpoint: 'https://accounts.example.com/o/userinfo',79 response_types_supported: ['code', 'id_token'],80 subject_types_supported: ['public'],81 id_token_signing_alg_values_supported: ['RS256'],82 scopes_supported: ['openid', 'email'],83 token_endpoint_auth_methods_supported: ['client_secret_basic'],84 code_challenge_methods_supported: ['S256'],85};86
87test('analyzeMetadata accepts a fully conformant document', () => {88 const r = analyzeMetadata(GOOD_DOC, 'https://accounts.example.com/.well-known/openid-configuration');89 assert.equal(r.valid, true);90 assert.equal(r.issuer, 'https://accounts.example.com');91 assert.equal(r.issuerMatchesFinalUrl, true);92 assert.deepEqual(r.missingRequired, []);93 assert.deepEqual(r.issues, []);94});95
96test('analyzeMetadata flags missing required keys', () => {97 const r = analyzeMetadata({ issuer: 'https://accounts.example.com' }, 'https://accounts.example.com/.well-known/openid-configuration');98 assert.equal(r.valid, false);99 assert.ok(r.missingRequired.includes('authorization_endpoint'));100 assert.ok(r.missingRequired.includes('jwks_uri'));101 assert.ok(r.missingRequired.includes('response_types_supported'));102 assert.ok(r.issues.some((i) => /Missing required metadata key 'authorization_endpoint'/.test(i)));103});104
105test('analyzeMetadata flags issuer mismatch with fetched URL', () => {106 const r = analyzeMetadata(GOOD_DOC, 'https://other.example.com/.well-known/openid-configuration');107 assert.equal(r.issuerMatchesFinalUrl, false);108 assert.equal(r.valid, false);109 assert.ok(r.issues.some((i) => /does not match the URL the document was fetched from/.test(i)));110});111
112test('analyzeMetadata flags issuer with query or fragment', () => {113 const doc = { ...GOOD_DOC, issuer: 'https://accounts.example.com/?x=1' };114 const r = analyzeMetadata(doc, 'https://accounts.example.com/?x=1');115 assert.ok(r.issues.some((i) => /MUST NOT contain a query or fragment/.test(i)));116});117
118test('analyzeMetadata flags non-https endpoint', () => {119 const doc = { ...GOOD_DOC, token_endpoint: 'http://accounts.example.com/o/token' };120 const r = analyzeMetadata(doc, 'https://accounts.example.com/.well-known/openid-configuration');121 assert.equal(r.valid, false);122 assert.ok(r.issues.some((i) => /'token_endpoint' must use https/.test(i)));123});124
125test('analyzeMetadata flags unparseable endpoint', () => {126 const doc = { ...GOOD_DOC, jwks_uri: 'not a url' };127 const r = analyzeMetadata(doc, 'https://accounts.example.com/.well-known/openid-configuration');128 assert.equal(r.valid, false);129 assert.ok(r.issues.some((i) => /not a parseable URL/.test(i)));130});131
132test('analyzeMetadata marks off-origin endpoints but keeps document core valid', () => {133 const doc = { ...GOOD_DOC, jwks_uri: 'https://keys.other-example.com/jwks.json' };134 const r = analyzeMetadata(doc, 'https://accounts.example.com/.well-known/openid-configuration');135 const jwks = r.endpoints.find((e) => e.key === 'jwks_uri');136 assert.equal(jwks.issuerHost, false);137 assert.equal(jwks.https, true);138 assert.equal(r.valid, true); // off-origin endpoint is a warn, not a fail139});140
141test('analyzeMetadata flags non-string endpoint value', () => {142 const doc = { ...GOOD_DOC, token_endpoint: 42 };143 const r = analyzeMetadata(doc, 'https://accounts.example.com/.well-known/openid-configuration');144 assert.equal(r.valid, false);145 assert.ok(r.issues.some((i) => /'token_endpoint' must be a string URL/.test(i)));146});147
148test('analyzeMetadata flags id_token none signing algorithm', () => {149 const doc = { ...GOOD_DOC, id_token_signing_alg_values_supported: ['RS256', 'none'] };150 const r = analyzeMetadata(doc, 'https://accounts.example.com/.well-known/openid-configuration');151 assert.equal(r.valid, false);152 assert.ok(r.issues.some((i) => /includes 'none'/.test(i)));153});154
155test('analyzeMetadata flags unknown signing algorithms', () => {156 const doc = { ...GOOD_DOC, id_token_signing_alg_values_supported: ['RS256', 'TOTALLY_MADE_UP'] };157 const r = analyzeMetadata(doc, 'https://accounts.example.com/.well-known/openid-configuration');158 assert.ok(r.issues.some((i) => /unrecognized algorithms: TOTALLY_MADE_UP/.test(i)));159});160
161test('analyzeMetadata flags invalid subject types', () => {162 const doc = { ...GOOD_DOC, subject_types_supported: ['public', 'groupwise'] };163 const r = analyzeMetadata(doc, 'https://accounts.example.com/.well-known/openid-configuration');164 assert.ok(r.issues.some((i) => /subject_types_supported' contains invalid values/.test(i)));165});166
167test('analyzeMetadata flags non-array response_types_supported', () => {168 const doc = { ...GOOD_DOC, response_types_supported: 'code' };169 const r = analyzeMetadata(doc, 'https://accounts.example.com/.well-known/openid-configuration');170 assert.ok(r.issues.some((i) => /'response_types_supported' must be a non-empty array/.test(i)));171});172
173test('analyzeMetadata flags non-string scopes', () => {174 const doc = { ...GOOD_DOC, scopes_supported: ['openid', 42] };175 const r = analyzeMetadata(doc, 'https://accounts.example.com/.well-known/openid-configuration');176 assert.ok(r.issues.some((i) => /'scopes_supported' must be an array of strings/.test(i)));177});178
179test('analyzeMetadata reports missing recommended keys', () => {180 const doc = {181 issuer: 'https://accounts.example.com',182 authorization_endpoint: 'https://accounts.example.com/o/auth',183 jwks_uri: 'https://accounts.example.com/.well-known/jwks.json',184 response_types_supported: ['code'],185 };186 const r = analyzeMetadata(doc, 'https://accounts.example.com/.well-known/openid-configuration');187 assert.ok(r.missingRecommended.includes('token_endpoint'));188 assert.ok(r.issues.some((i) => /Recommended keys missing/.test(i)));189 // Recommended keys missing is advisory: core spec validity holds.190 assert.equal(r.valid, true);191});192
193test('analyzeMetadata rejects non-object document', () => {194 const r = analyzeMetadata('just a string', 'https://accounts.example.com/.well-known/openid-configuration');195 assert.equal(r.valid, false);196 assert.ok(r.issues.some((i) => /not a JSON object/.test(i)));197});198
199/* ---------------------------------------------------------------------------200 * Check building, scoring, grading201 * ------------------------------------------------------------------------- */202
203function goodContext() {204 const analysis = analyzeMetadata(GOOD_DOC, 'https://accounts.example.com/.well-known/openid-configuration');205 return {206 docFetch: {207 error: null,208 status: 200,209 finalUrl: 'https://accounts.example.com/.well-known/openid-configuration',210 contentType: 'application/json',211 https: true,212 body: JSON.stringify(GOOD_DOC),213 },214 doc: GOOD_DOC,215 analysis,216 issuerHttps: true,217 };218}219
220test('buildCheckReports scores a conformant provider as good', () => {221 const { reports, earned, possible } = buildCheckReports(goodContext());222 assert.equal(possible, 100);223 assert.equal(earned, 100);224 assert.equal(scoreAudit(earned, possible), 100);225 assert.ok(reports.every((r) => r.status === 'good'));226});227
228test('buildCheckReports flags issuer mismatch as missing', () => {229 const ctx = goodContext();230 const badDoc = { ...GOOD_DOC, issuer: 'https://elsewhere.example.com' };231 ctx.doc = badDoc;232 ctx.analysis = analyzeMetadata(badDoc, ctx.docFetch.finalUrl);233 const { reports } = buildCheckReports(ctx);234 const issuer = reports.find((r) => r.check === 'issuer');235 assert.equal(issuer.status, 'missing');236 assert.ok(/does not match/.test(issuer.note));237});238
239test('buildCheckReports warns on missing PKCE advertisement', () => {240 const ctx = goodContext();241 const noPkce = { ...GOOD_DOC };242 delete noPkce.code_challenge_methods_supported;243 ctx.doc = noPkce;244 ctx.analysis = analyzeMetadata(noPkce, ctx.docFetch.finalUrl);245 const { reports } = buildCheckReports(ctx);246 const pkce = reports.find((r) => r.check === 'pkce');247 assert.equal(pkce.status, 'warn');248 assert.ok(/PKCE is not advertised/.test(pkce.note));249});250
251test('buildCheckReports fails plain PKCE method', () => {252 const ctx = goodContext();253 const plainPkce = { ...GOOD_DOC, code_challenge_methods_supported: ['plain'] };254 ctx.doc = plainPkce;255 ctx.analysis = analyzeMetadata(plainPkce, ctx.docFetch.finalUrl);256 const { reports } = buildCheckReports(ctx);257 const pkce = reports.find((r) => r.check === 'pkce');258 assert.equal(pkce.status, 'missing');259 assert.ok(/'plain'/.test(pkce.note));260});261
262test('buildCheckReports fails fetch error', () => {263 const ctx = goodContext();264 ctx.docFetch = { ...ctx.docFetch, error: 'fetch failed', status: null, https: false };265 ctx.doc = null;266 ctx.analysis = {267 valid: false, issuer: null, issuerMatchesFinalUrl: false, requiredKeys: [],268 missingRequired: [], missingRecommended: [], presentKeys: [], endpoints: [], issues: [],269 };270 const { reports, possible } = buildCheckReports(ctx);271 const doc = reports.find((r) => r.check === 'document');272 assert.equal(doc.status, 'missing');273 assert.ok(possible > 0);274});275
276test('scoreAudit computes percentage and clamps', () => {277 assert.equal(scoreAudit(100, 100), 100);278 assert.equal(scoreAudit(50, 100), 50);279 assert.equal(scoreAudit(0, 0), 0);280 assert.equal(scoreAudit(999, 100), 100);281});282
283test('gradeFromScore maps bands', () => {284 assert.equal(gradeFromScore(97), 'A+');285 assert.equal(gradeFromScore(90), 'A');286 assert.equal(gradeFromScore(78), 'B');287 assert.equal(gradeFromScore(66), 'C');288 assert.equal(gradeFromScore(55), 'D');289 assert.equal(gradeFromScore(35), 'E');290 assert.equal(gradeFromScore(10), 'F');291});292
293/* ---------------------------------------------------------------------------294 * Recommendations295 * ------------------------------------------------------------------------- */296
297test('buildRecommendations collects unique check recommendations', () => {298 const recs = buildRecommendations([299 { recommendation: 'Publish S256.' },300 { recommendation: 'Publish S256.' },301 { recommendation: null },302 ]);303 assert.deepEqual(recs, ['Publish S256.']);304});305
306test('buildRecommendations falls back to a positive note', () => {307 const recs = buildRecommendations([{ recommendation: null }]);308 assert.equal(recs.length, 1);309 assert.ok(/spec-conformant/.test(recs[0]));310});311
312/* ---------------------------------------------------------------------------313 * Live smoke test against a real public IdP (network-dependent, skipped on failure)314 * ------------------------------------------------------------------------- */315
316test('live smoke: auditOidcDiscovery returns a structured result for a public IdP', { timeout: 45000 }, async () => {317 const { auditOidcDiscovery } = await import('../src/main.js');318 try {319 const result = await auditOidcDiscovery({ issuer: 'https://accounts.google.com', timeoutSeconds: 15 });320 assert.equal(result.error ?? null, null);321 assert.equal(result.documentFound, true);322 assert.equal(result.jsonValid, true);323 assert.equal(result.issuerMatchesFinalUrl, true);324 assert.equal(typeof result.score, 'number');325 assert.equal(typeof result.grade, 'string');326 assert.equal(Array.isArray(result.checks), true);327 assert.equal(Array.isArray(result.recommendations), true);328 assert.ok(result.endpoints.length >= 3);329 assert.ok(result.responseTypes.includes('code'));330 } catch (err) {331 if (/blocked|ENOTFOUND|EAI_AGAIN|fetch failed|timeout/i.test(String(err?.message || err))) {332 return; // network unavailable in this environment; parsers covered above333 }334 throw err;335 }336});