Farmer1st IdP E2E

Browser smoke harness for Kratos, Hydra, consent-provider, and OAuth callback wiring.

Ready

Configuration

Public checks

Readiness and OIDC metadata only. Run OAuth separately to verify a login transaction.

Account acceptance journey

Use one authorized test account. SES sandbox permits only the configured verified test recipient. OAuth does not request a verification email.

  1. Create account, then sign in and check the session.
  2. Request verification email / enter code. Confirm inbox receipt, complete the native flow, then use Check email verification.
  3. Run Start OAuth: state, signature, issuer/audience/time claims, nonce and UserInfo must all pass.
  4. Test account recovery, then sign in with the recovered account. Account settings / available MFA methods.
  5. Sign out and verify that the session endpoint returns 401. Test a wrong password and an expired/reused verification or recovery code separately.

An email request or active session does not prove delivery. Recovery, MFA, negative cases and inbox receipt require separate evidence.

PII and consent qualification

Sign in with the dedicated owner client to prepare your own PII and consent operations. Its access token stays in this page’s memory for at most five minutes; navigating away clears it.

Owner access not established.

Not executed by this portal: Consent Engine allow/deny/revocation, KMS key access, PII write/read/detokenization, cross-user isolation, GDPR export/erasure and audit continuity. These require a dedicated authenticated synthetic-data suite; public readiness and openid OAuth cannot qualify them.

The report contains only observations from this page, with timestamps. Navigation resets it. It is not a signed audit record or proof that separate observations belong to the same identity.

Result

Waiting for action.