id-token-reviewer

maronnjapan's avatarfrom maronnjapan

Review test cases for ID Token validation. Covers ID Token structure, required/conditional claims, signature validation (RS256), and all validation rules per OIDC Core 1.0 Section 2 and 3.1.3.7.

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 31, 2025
[Testing and QA]

When & Why to Use This Skill

This Claude skill serves as a specialized auditor for OpenID Connect (OIDC) implementations, specifically focusing on ID Token validation. It automates the review of test cases against OIDC Core 1.0 specifications, ensuring that token structures, required claims (iss, sub, aud, exp, iat), and RS256 signatures meet strict security and compliance standards. By providing a systematic checklist and structured output, it helps developers and QA engineers identify security gaps and specification deviations in their authentication flows.

Use Cases

  • OIDC Compliance Auditing: Systematically reviewing test suites to ensure an Identity Provider (OP) correctly implements all validation rules defined in OIDC Core 1.0 Section 3.1.3.7.
  • Security Edge-Case Identification: Detecting missing test scenarios for invalid tokens, such as incorrect issuer formats, expired timestamps, or mismatched nonces that could lead to authentication vulnerabilities.
  • Automated QA Feedback: Generating structured review reports for developers that highlight specific specification sections (e.g., RS256 signature requirements) where test coverage is insufficient.
  • Authentication Flow Debugging: Verifying the integrity of JWT structures and JOSE headers during the development of Basic OP (Authorization Code Flow) profiles.
nameid-token-reviewer
descriptionReview test cases for ID Token validation. Covers ID Token structure, required/conditional claims, signature validation (RS256), and all validation rules per OIDC Core 1.0 Section 2 and 3.1.3.7.

ID Token Test Case Reviewer

Review test cases for ID Token generation and validation in OpenID Connect Basic OP.

Scope

  • Feature: ID Token Claims and Signature
  • Specifications: OIDC Core 1.0 Section 2, 3.1.3.6, 3.1.3.7
  • Profile: Basic OP (Authorization Code Flow)

Review Process

  1. Identify which ID Token requirement the test targets
  2. Check against the checklist below
  3. Verify both valid and invalid token scenarios
  4. Ensure signature algorithm (RS256) is tested
  5. Report gaps with specific spec section references

ID Token Structure

Header.Payload.Signature

JOSE Header Requirements

Field Requirement Example
alg REQUIRED. Signing algorithm RS256
kid RECOMMENDED. Key ID 1e9gdk7
typ OPTIONAL. Type JWT

Required Claims Checklist

Check Claim Requirement Spec Reference
[ ] iss REQUIRED. Issuer Identifier (HTTPS URL, no query/fragment) OIDC Core 2
[ ] sub REQUIRED. Subject Identifier (max 255 ASCII chars) OIDC Core 2
[ ] aud REQUIRED. Audience (contains client_id) OIDC Core 2
[ ] exp REQUIRED. Expiration time OIDC Core 2
[ ] iat REQUIRED. Issued at time OIDC Core 2

Conditional Claims Checklist

Check Claim Condition Spec Reference
[ ] nonce REQUIRED if nonce in auth request OIDC Core 3.1.3.6
[ ] auth_time REQUIRED if max_age requested or auth_time essential OIDC Core 2
[ ] azp REQUIRED if aud contains multiple values OIDC Core 2
[ ] at_hash OPTIONAL for code flow OIDC Core 3.1.3.6

Signature Requirements

Check Requirement Spec Reference
[ ] ID Token MUST be signed JWT OIDC Core 2
[ ] Support RS256 algorithm (MANDATORY) OIDC Core 15.1
[ ] alg header parameter present OIDC Core 2
[ ] kid header parameter present if multiple keys OIDC Core 10.1

Validation Rules (OP produces valid tokens)

Check Validation Rule Spec Reference
[ ] iss exactly matches OP's Issuer Identifier OIDC Core 3.1.3.7
[ ] aud contains requesting client's client_id OIDC Core 3.1.3.7
[ ] exp is in the future OIDC Core 3.1.3.7
[ ] Signature verifiable with OP's public key OIDC Core 3.1.3.7

Test Case Categories

Issuer (iss) Tests

  • Valid: iss matches configured OP issuer exactly
  • Invalid: iss adds query parameters
  • Invalid: iss adds fragment
  • Invalid: iss differs by trailing slash
  • Invalid: iss differs by scheme (http vs https)
  • Invalid: iss is missing

Audience (aud) Tests

  • Valid: aud equals client_id (string)
  • Valid: aud is array containing client_id
  • Invalid: aud doesn't contain client_id
  • Invalid: aud is missing

Authorized Party (azp) Tests

  • Valid: Single aud, no azp required
  • Valid: Multiple aud, azp equals client_id
  • Warning: Multiple aud, azp missing
  • Invalid: azp present but doesn't match client_id

Expiration (exp) Tests

  • Valid: exp is in future
  • Valid: Small clock skew tolerance (typically 5 minutes)
  • Invalid: exp is in past
  • Invalid: exp is missing

Nonce Tests

  • Valid: nonce matches request nonce
  • Valid: No nonce in request, no nonce in token (code flow)
  • Invalid: nonce requested but missing in token
  • Invalid: nonce doesn't match request

Signature Tests

  • Valid: RS256 signature verifies with OP's public key
  • Valid: Retrieve key via kid from JWKS
  • Invalid: Signature doesn't verify
  • Invalid: Unknown kid
  • Invalid: Algorithm mismatch
  • Invalid: alg is none when signature required

Review Output Format

## Test Case: [Name]
### Target Feature: ID Token - [specific aspect]
### Test ID: OP-IDToken-[xxx]
### Spec Compliance:
- [x] Covers required behavior per [spec section]
- [ ] Missing: [specific requirement]
### Verdict: PASS / FAIL / PARTIAL
### Recommendations: [if any]

Example Valid ID Token

{
  "iss": "https://server.example.com",
  "sub": "248289761001",
  "aud": "s6BhdRkqt3",
  "nonce": "n-0S6_WzA2Mj",
  "exp": 1311281970,
  "iat": 1311280970
}