All posts

Introducing IDPTools: An Open Source OAuth2 & OpenID Connect Debugger

by Robert Broeckelmann

If you’ve spent any amount of time integrating OAuth 2.0 or OpenID Connect (OIDC), you’ve probably experienced the same cycle:

“Why is my redirect URI wrong?” “Where did that state parameter disappear to?” “Why is the identity provider rejecting my request?” “What exactly did the authorization server send back?”

After years of building identity integrations, I found myself writing the same helper scripts, browser extensions, and temporary applications over and over again just to inspect requests and troubleshoot authentication flows.

Eventually, I decided it was time to build a dedicated tool.

Today I’m happy to announce the public release of IDPTools.

🌐 https://idptools.com

What is IDPTools?

IDPTools is a free, browser-based debugging toolkit for engineers working with:

  • OAuth 2.0
  • OpenID Connect (OIDC)
  • JWTs
  • Identity Providers (IdPs)
  • Authorization Servers
  • Enterprise SSO integrations

The goal is simple enough. Make diagnosing authentication and authorization problems dramatically easier.

Whether you’re integrating Microsoft Entra ID, Keycloak, Okta, Auth0, Ping Identity, ForgeRock, Google, AWS Cognito, or a custom identity provider, debugging protocol interactions shouldn’t require writing throwaway code every time.

Open Source

One of the primary goals of this project was transparency.

The entire project is open source and available on GitHub:

Repository: oauth2-oidc-debugger

Contributions, bug reports, feature requests, and pull requests are always welcome.

Privacy First

Identity debugging frequently involves sensitive information.

Because of that, IDPTools was designed with privacy as a core principle.

Current design characteristics include:

  • No backend processing of your protocol messages
  • No storage of your OAuth2 or OIDC data
  • No persistence of tokens or requests
  • Processing occurs entirely within your browser

Google Analytics is used only to understand site usage and performance — not to inspect OAuth2 messages or authentication data.

Supported by Iya CyberSecurity Solutions

This project is supported by Iya CyberSecurity Solutions (IyaSec) and a small community of Open Source developers.

IyaSec focuses on identity, application security, and cloud security. Supporting open-source security tools is one way we hope to give something useful back to the identity community.

This Is Just the Beginning

The initial release focuses on OAuth2 / OpenID Connect debugging and supporting functions such as hashing / digital signatures / encryption, but the long-term vision for IDPTools is much broader.

Planned areas of expansion include:

  • OpenID Federation
  • OAuth 2.1
  • Verifiable Credentials (OID4VCI / OID4VP)
  • JWT inspection utilities
  • JOSE tooling
  • JWK management
  • SAML debugging
  • Token exchange
  • DPoP
  • Rich Authorization Requests (RAR)
  • Security and protocol analysis tools

The identity ecosystem continues to evolve rapidly, and I’d like IDPTools to evolve with it.

Get Involved

If you build identity solutions, I’d love your feedback.

Try the debugger:

Website: IDPTools

Explore the code:

GitHub: oauth2-oidc-debugger Repository

If you encounter a bug, have an idea for a new feature, or would like to contribute, please open an issue or submit a pull request.

Identity protocols are complicated enough. The tools we use to understand them shouldn’t be.

I hope IDPTools helps make that job a little easier.

Originally published on Medium.

More articles