Package: ofcli
ofcliThis is a helper CLI tool for exploring OIDC federations.Installationofcli works with Python 3.7+.The recommended way to installofcliis withpip:pipinstallofcliThis will ensure that the stable version is fetched from pip, rather than the development version.UsageUsage:ofcli[OPTIONS]COMMAND[ARGS]...ToolforexploringanOIDCfederation.

Options:--insecureDisableTLScertificateverification.--log-levelLEVELEitherCRITICAL,ERROR,WARNING,INFOorDEBUG.Defaultvalue:ERROR.[envvar:LOG]--debugSetsthelogleveltoDEBUG.--versionPrintprogramversionandexit.--helpShowthismessageandexit.

Commands:discoveryDiscoverallOPsinthefederationavailabletoagivenRP.Ifnotrustanchorisspecified,allpossibletrustanchorswillbeused.entityCommandsforworkingwithanentityinanOIDCfederation.fetchFetchanentitystatementlistListallsubordinateentities.resolveResolvemetadataandTrustMarksforanentity,givenatrustanchorandentitytype.subtreeDiscoverfederationsubtreeusinggivenentityasroot.trustchainsBuildsalltrustchainsforagivenentityandprintsthem.For each subcommand, you can use the--helpflag to get more information about the subcommand.$ofclitrustchains--help
Usage:ofclitrustchains[OPTIONS]ENTITY_IDBuildsalltrustchainsforagivenentityandprintsthem.Ifanytrustanchorisspecified,onlytrustchainsendinginthetrustanchorwillbeshown.

Options:--ta,--trust-anchorTA_IDTrustanchorIDtouseforbuildingtrustchains(multipleTAspossible).--exportDOT_FILEExporttrustchainstoadotfile.--detailsPrintstrustchainswithadditionaldetails,includingentitystatementsandexpirationdates.--insecureDisableTLScertificateverification.--log-levelLEVELEitherCRITICAL,ERROR,WARNING,INFOorDEBUG.Defaultvalue:ERROR.[envvar:LOG]--debugSetsthelogleveltoDEBUG.--versionPrintprogramversionandexit.--helpShowthismessageandexit.ExamplesFollowing, various example outputs.Trustchains$ofclitrustchainshttps://op.fedservice.lh--exportop-chains
*https://op.fedservice.lh->https://trust-anchor.spid-cie.fedservice.lh/
*https://op.fedservice.lh->https://umu.fedservice.lh->https://swamid.fedservice.lh
*https://op.fedservice.lh->https://umu.fedservice.lh->https://seid.fedservice.lhThis will export the trust tree for the entityhttps://op.fedservice.lhto the fileexamples/op-chains.dotin theDOT language.The file can be converted to an image using thedotcommand from theGraphvizpackage (or any other tool that can read DOT files):dot-Tpngexamples/op-chains.dot-oexamples/op-chains.pngFederation discoveryDiscovering all entities in a sub-federation given by its root entity:$ofclisubtreehttps://swamid.fedservice.lh--exportswamid-fed
-https://swamid.fedservice.lh(federation_entity)-https://umu.fedservice.lh(federation_entity)-https://op.fedservice.lh(openid_provider)-https://lu.fedservice.lh(federation_entity)-https://auto.fedservice.lh(openid_relying_party)This will export the federation tree for the entityhttps://swamid.fedservice.lhto the fileexamples/swamid-fed.dot, which can be rendered as an image as described above.Metadata resolutionResolving metadata for an entity, given a trust anchor, will apply all metadata policies along the trustchain found for the given trust anchor, and return the resulting metadata.$ofcliresolvehttps://op.fedservice.lh--tahttps://trust-anchor.spid-cie.fedservice.lh/--entity-typeopenid_providerThis will return the metadata for the entityhttps://op.fedservice.lhas it would be seen by an entity that hashttps://trust-anchor.spid-cie.fedservice.lh/as a trust anchor (seeexamples/op-resolved-metadata.json).REST APIofclialso provides a REST API for the same functionality as the CLI. The API is documented usingOpenAPIand can be explored using theSwagger UI.To run the API, use theofapicommand. This will start a web server on port 12345 by default, but this can be changed using the--portoption.$ofapi--port8080The API consists of the following endpoints:/entity/{entity_id:path}: Returns the decoded self-signed entity configuration for given entity_id./fetch: Fetches an entity statement for a given entity ID from a given federation entity./list/{entity_id:path}: Lists all subordinates of an entity./trustchains/{entity_id:path}: Builds all trustchains for a given entity and prints them. If any trust anchor is specified via a query parameter, only trustchains ending in the trust anchor will be returned./subtree/{entity_id:path}: Discover federation subtree using given entity as root./resolve/{entity_id:path}: Resolve metadata and Trust Marks for an entity, given a trust anchor and entity type via query parameters./discovery/{entity_id:path}: Discover all OPs in the federation available to a given RP. If no trust anchor is specified via query parameters, all possible trust anchors will be used.DevelopmentInstalling the development versionThe development version ofofclican be installed from themainbranch of thegit repositoryand can be installed as follows (note the-eswitch to install it in editable or "develop mode"):gitclonehttps://github.com/dianagudu/ofclicdofcli
pipinstall-e.VersioningVersions are managed bybump2version. To bump the version, run:bump2version[major|minor|patch]This will increase the version accordingly and commit the change.Build the packagepython-mbuild--sdist--wheelIf you're running theOIDCfed testbedlocally with self-signed certificates, you'll first need to trust the mkcert CA certificate:pipinstallcertifi
cat"`mkcert -CAROOT`/rootCA.pem">>`python-mcertifi`This work was started in and supported by theGeant Trust & Identity Incubator.