Developer tooling · Apache 2.0

oidc-discovery-validator

Go CLI that validates an OIDC discovery document against RFC 8414 + OpenID Connect Discovery 1.0 + common anti-patterns.

View on GitHub →Go

About

Open-source CLI tool that fetches a `.well-known/openid-configuration` document, validates it against the OIDC Discovery 1.0 specification + RFC 8414 (OAuth 2.0 Authorization Server Metadata), and flags common anti-patterns: missing required fields, mismatched issuer, unreachable JWKS, supported_response_types containing legacy flows, deprecated signing algorithms.

Complements the interactive web tool at /tools/oidc-discovery-validator/ with a CLI version suitable for CI gating. Designed to be runnable against any OIDC provider — internal and SaaS.

Features

Validates OIDC Discovery + RFC 8414 conformance
Issuer / metadata-URL mismatch detection
JWKS reachability + JWK validation
Flags legacy response_types (implicit, password)
Flags deprecated signing algorithms (HS256 in some contexts, none)
CI-friendly exit codes
JSON output mode

Install

# Homebrew
brew install askmeidentity/tap/oidc-discovery-validator

# Go install
go install github.com/askmeidentity/oidc-discovery-validator@latest

Usage

oidc-discovery-validator validate https://accounts.example.com/
# or with explicit metadata URL
oidc-discovery-validator validate \
  --metadata-url https://accounts.example.com/.well-known/openid-configuration

Related resources