easyssf
Tools
Security Event Tokens to try a receiver with, or to show what a CAEP, RISC or SCIM event looks like.
Security Event Token generator
Pick an event type and get a complete example right away, as the SET's JSON and signed as a JWT with a key generated in your browser; then change the subject, the claims and the token as you need. The event types and their claims follow CAEP 1.0, RISC 1.0, RFC 9967 (SCIM Events) and SSF 1.0; the subject identifiers RFC 9493 and the additional formats of SSF. The event types below list them all with their claims and the alias easyssf accepts for each.
The claims of the SET, RFC 8417: the event under its type URI in events, the subject in
sub_id. The JWT tab has it signed. "Copy event" copies the payload of the event alone, for a
transmitter that wraps it in a SET itself.
Header, typ secevent+jwt as SSF requires:
A receiver verifies the signature with the keys the issuer publishes at the jwks_uri of its
.well-known/ssf-configuration, so it accepts this token only if that key set contains the
browser key. Set an iss you control and serve the key set there, or use the inspector below
to read the token.
The key, as a JWK Set and as a private JWK
Security Event Token inspector
Paste a SET you received, or one from the generator, to read its header and claims. Event types are shown with their easyssf alias. The signature is not verified here.
Event types
Every event type the specifications define and easyssf knows, with its claims. The
specifications identify event types by URI; easyssf accepts those URIs everywhere, and additionally the short alias
shown with each event, usable in events-requested, in SsfEventContext.hasEvent() and wherever
else an event type is named. The aliases are an easyssf convention, not part of the specifications; a SET always
carries the URI. You can register your own aliases for vendor-specific types, see the
README.
Each event can be linked to: tools.html#event-CaepSessionRevoked opens its
card here, tools.html#generate=CaepSessionRevoked opens it in the generator. Instead of the alias, the
fragment can name the event by its URI, as caep/session-revoked or just session-revoked.
Transmitter metadata checker
Checks a transmitter's configuration metadata, the document at
/.well-known/ssf-configuration, against section 7 of SSF 1.0:
the required and recommended members, the URLs, the delivery methods and the authorization schemes, and what a
receiver can do with the transmitter. Enter the issuer to fetch the document, or paste it.
Other tools
The generator shows what a SET looks like; to see a receiver react, it needs a transmitter whose keys it can fetch. These do that.
caep.dev
A free, hosted Shared Signals transmitter by SGNL, made for trying receivers: sign in, create a stream with push or poll delivery to your application, and send CAEP events to it from the browser. It publishes its transmitter metadata and keys, so an easyssf receiver verifies the SETs like those of any identity provider. It can play the receiver as well, for when easyssf gains a transmitter.
OpenID conformance suite
The official test plans for SSF receivers, default and CAEP interoperability profile, with push and poll
delivery. easyssf-test-conformance runs them against a receiver from a JUnit test, with the suite in
a container.
easyssf-test
A transmitter inside your test JVM: it signs SETs, serves metadata and keys, hands out tokens and emulates the stream and poll endpoints, for the integration tests of your own receiver.
shared-signals.dev
An independent developer guide to the Shared Signals standards: concepts (transmitters, receivers, streams, SETs, subjects), summaries of SSF, CAEP and RISC, a catalogue of event types with their claims and example tokens, and a directory of implementations. Its playground runs a public transmitter and receiver to test your own implementation against.