Flow Walkthroughs
Use this method to evaluate any flow with consistent evidence.
Repeatable Method
Section titled “Repeatable Method”- Choose a flow from the Protocol Catalog and define the expected outcome.
- Check prerequisites — some flows need an existing token (refresh, introspection), a prior credential (OID4VP), or SPIFFE mode enabled.
- Execute the flow in Looking Glass.
- Inspect the event timeline — click each step to see full payloads.
- Interpret validation outcomes and security annotations.
- Rerun with one changed variable to confirm control behavior.
Recommended Starting Flows
Section titled “Recommended Starting Flows”| Protocol | Flow | Why Start Here |
|---|---|---|
| OAuth 2.0 | Authorization Code + PKCE | Core delegated authorization with modern security |
| OIDC | Authorization Code + UserInfo | Identity layer on OAuth, ID token claims |
| SAML 2.0 | SP-Initiated SSO | Enterprise SSO entry pattern, assertion inspection |
| SCIM 2.0 | User Lifecycle | Full CRUD cycle with PATCH semantics |
| SPIFFE | X.509-SVID Issuance | Workload identity fundamentals |
| SSF | CAEP Session Revoked | Real-time security event stream with receiver response |
| OID4VCI | Pre-Authorized Code | Credential issuance (SD-JWT VC, JWT VC, LDP VC) |
| OID4VP | DCQL + direct_post | Verifier request and wallet submission |
Interpreting Outcomes
Section titled “Interpreting Outcomes”Success
Section titled “Success”Inspect the resulting artifacts:
- Tokens: Verify claims, audience, issuer, expiry, and signature algorithm.
- Assertions: Check subject, conditions, attribute statements.
- Credentials: Validate VCT, selective disclosure claims, proof binding.
- SVIDs: Confirm SPIFFE ID, trust domain, and certificate chain.
Validation Failure
Section titled “Validation Failure”Check alignment of:
- Nonce and state parameters
- Audience restrictions
- Signature keys and algorithms
- Token expiry and not-before constraints
- Redirect URI registration
Policy Denial
Section titled “Policy Denial”A denied flow is not necessarily an error. It may indicate:
- Correct scope enforcement (requesting a scope the client is not authorized for)
- PKCE enforcement (missing or mismatched code verifier)
- Consent requirements
- Session policy enforcement (SSF receiver revoking a session)