Aparência
finnest opin
Verify OPIN provider-DCR readiness and emit the conformance suite test-plan config.
Run the OPIN acceptance ladder: build the sanitized provider-DCR target report (must show zero warnings), then probe DCR registration over mTLS when BRCAC + SSA material is provided, then — when Directory coordinates are given (--org-id/--as-id/--brcac-cert/--brcac-key) — confirm the registered Directory Authorisation Server record still points at the deployed realm with DCR enabled. Without material the probe is reported as skipped — pass --allow-skip to accept that explicitly; 201 requires confirmed DCM cleanup to pass; 409 leaves acceptance unverified and requires reconciliation before retrying.
Grupo: Diagnóstico e suporte · Nível: secundário
Uso
bash
finnest opin <subcomando> [opções]Exemplos
bash
finnest opin status
finnest opin status --json
finnest opin verify
finnest opin verify --allow-skip
finnest opin verify --brcac-cert ./brcac.pem --brcac-key ./brcac.key --ssa-file ./ssa.jwt
finnest opin verify --org-id ORG --as-id AS --directory-client-id CLIENT --brcac-cert ./brcac.pem --brcac-key ./brcac.key
finnest opin conformance --emit-plan
finnest opin conformance --emit-plan --auth-method tls_client_auth --out ./conformance-plan.json
finnest opin conformance rp --suite-token-env OIDF_SUITE_TOKEN --modules staticOpções
--auth-base <url>— Authorization server base URL (non-mTLS host) for the OPIN target report.--matls-auth-base <url>— Regulated mTLS authorization host base URL (matls-auth.<domain>).--realm <realm>— Authorization realm for the OPIN target report (default finnest-opin).--brcac-cert <path>— Path to the BRCAC client certificate PEM used for mTLS.--brcac-key <path>— Path to the BRCAC client key PEM used for mTLS.--ssa-file <path>— Path to a compact SSA JWT file for dcr ssa-summary.--ssa-env <name>— Automation compatibility: name of an existing environment variable holding the compact SSA JWT; operators should use --ssa-file or dcr fetch-ssa.--ca-bundle <path>— Optional CA bundle PEM override; Directory commands otherwise use the configured ICP-Brasil trust material.--allow-skip— Accept a skipped DCR probe (no BRCAC/SSA material) as a passing opin verify.--org-id <id>— Directory organisation id used to build the SSA endpoint path.--as-id <id>— Directory Authorisation Server id used to check the registered AS record.--directory-base <url>— OPIN Directory mTLS API base; token endpoint comes from issuer discovery.--directory-client-id <id>— Directory Software Statement ClientId used to obtain the Directory token.--environment <environment>— Target environment: sandbox or prod.--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.
Subcomandos
verify— Run an active mTLS registration probe; acceptance requires successful cleanup.conformance— Emit the OIDF test-plan config (--emit-plan), or run the official RP plan against the receiver (rp).status— Read-only readiness board; DCR acceptance requires an explicit opin verify run.directory— Read-only OPIN Directory introspection over your BRCAC: link / diff / certs.
finnest opin verify
Run an active mTLS registration probe; acceptance requires successful cleanup.
Opções
--auth-base <url>— Authorization server base URL (non-mTLS host) for the OPIN target report.--matls-auth-base <url>— Regulated mTLS authorization host base URL (matls-auth.<domain>).--realm <realm>— Authorization realm for the OPIN target report (default finnest-opin).--brcac-cert <path>— Path to the BRCAC client certificate PEM used for mTLS.--brcac-key <path>— Path to the BRCAC client key PEM used for mTLS.--ssa-file <path>— Path to a compact SSA JWT file for dcr ssa-summary.--ssa-env <name>— Automation compatibility: name of an existing environment variable holding the compact SSA JWT; operators should use --ssa-file or dcr fetch-ssa.--ca-bundle <path>— Optional CA bundle PEM override; Directory commands otherwise use the configured ICP-Brasil trust material.--allow-skip— Accept a skipped DCR probe (no BRCAC/SSA material) as a passing opin verify.--org-id <id>— Directory organisation id used to build the SSA endpoint path.--as-id <id>— Directory Authorisation Server id used to check the registered AS record.--directory-base <url>— OPIN Directory mTLS API base; token endpoint comes from issuer discovery.--directory-client-id <id>— Directory Software Statement ClientId used to obtain the Directory token.--environment <environment>— Target environment: sandbox or prod.--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.
finnest opin conformance
Emit the OIDF test-plan config (--emit-plan), or run the official RP plan against the receiver (rp).
--emit-plan emits the transmitter test-plan config prefilled from live discovery. rp creates a new plan on the hosted OIDF suite (fapi1-advanced-final-client-test-plan, OPIN variant) and drives every selected module headlessly: it seeds each module as an authorisation server, opens a connection with a synthetic holder CPF, and completes the redirect. The receiver bearer is minted per module from the finnest-opin-conformance client (conformance mode seeds its secret); the suite API token is read from the variable --suite-token-env names and is never written. Each run writes the suite result, the allowlisted log projection of each module, and the receiver failures and rows it created to the run evidence; raw suite logs are never written. rp exits 0 only when every selected module passes strictly: suite PASSED, no log findings, the receiver evidence present, and no receiver failure.
Argumentos
[action]— rp: run the official OIDF RP plan against the sandbox receiver in conformance mode. Valores:rp.
Exemplos
bash
finnest opin conformance --emit-plan
finnest opin conformance rp --suite-token-env OIDF_SUITE_TOKEN
finnest opin conformance rp --suite-token-env OIDF_SUITE_TOKEN --modules static
finnest opin conformance rp --suite-token-env OIDF_SUITE_TOKEN --modules fapi1-advanced-final-client-brazildcr-happypath-test --jsonOpções
--emit-plan— Emit the OPIN conformance suite test-plan config prefilled from live discovery.--auth-base <url>— Authorization server base URL (non-mTLS host) for the OPIN target report.--matls-auth-base <url>— Regulated mTLS authorization host base URL (matls-auth.<domain>).--realm <realm>— Authorization realm for the OPIN target report (default finnest-opin).--auth-method <method>— Token-endpoint auth method for the emitted conformance variant (default private_key_jwt). Valores:private_key_jwt,tls_client_auth.--out <path>— Write the command output to this file (created with 0600 permissions).--suite-token-env <name>— Name of the environment variable holding the conformance suite API token (created in the suite UI; never written to disk).--modules <selection>— RP plan modules to run: static, dynamic, or comma-separated module names (default: every module).--holder-cpf <cpf>— Holder CPF the receiver sends in each conformance consent (default: a synthetic CPF generated for the run).--directory-client-id <id>— Directory Software Statement ClientId used to obtain the Directory token.--environment <environment>— Target environment: sandbox or prod.--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.
finnest opin status
Read-only readiness board; DCR acceptance requires an explicit opin verify run.
Opções
--auth-base <url>— Authorization server base URL (non-mTLS host) for the OPIN target report.--matls-auth-base <url>— Regulated mTLS authorization host base URL (matls-auth.<domain>).--realm <realm>— Authorization realm for the OPIN target report (default finnest-opin).--brcac-cert <path>— Path to the BRCAC client certificate PEM used for mTLS.--brcac-key <path>— Path to the BRCAC client key PEM used for mTLS.--ssa-file <path>— Path to a compact SSA JWT file for dcr ssa-summary.--ssa-env <name>— Automation compatibility: name of an existing environment variable holding the compact SSA JWT; operators should use --ssa-file or dcr fetch-ssa.--ca-bundle <path>— Optional CA bundle PEM override; Directory commands otherwise use the configured ICP-Brasil trust material.--org-id <id>— Directory organisation id used to build the SSA endpoint path.--as-id <id>— Directory Authorisation Server id used to check the registered AS record.--directory-base <url>— OPIN Directory mTLS API base; token endpoint comes from issuer discovery.--directory-client-id <id>— Directory Software Statement ClientId used to obtain the Directory token.--environment <environment>— Target environment: sandbox or prod.--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.
finnest opin directory
Read-only OPIN Directory introspection over your BRCAC: link / diff / certs.
Introspect the OPIN Directory with the customer's BRCAC over mTLS plus a directory:software bearer (no Finnest control plane). link auto-fills the per-tenant [opin] org/AS/software ids into finnest.toml; diff catches AS-record drift vs the deployed issuer; certs is the certificate expiry radar. The sandbox Directory host comes from the resolved context; override with --directory-base.
Exemplos
bash
finnest opin directory link --directory-client-id CLIENT --brcac-cert ./brcac.pem --brcac-key ./brcac.key
finnest opin directory link --org-id ORG --as-id AS --software-id SS --directory-client-id CLIENT --brcac-cert ./brcac.pem --brcac-key ./brcac.key
finnest opin directory diff --directory-client-id CLIENT --brcac-cert ./brcac.pem --brcac-key ./brcac.key
finnest opin directory certs --json --directory-client-id CLIENT --brcac-cert ./brcac.pem --brcac-key ./brcac.keyOpções
--auth-base <url>— Authorization server base URL (non-mTLS host) for the OPIN target report.--matls-auth-base <url>— Regulated mTLS authorization host base URL (matls-auth.<domain>).--realm <realm>— Authorization realm for the OPIN target report (default finnest-opin).--brcac-cert <path>— Path to the BRCAC client certificate PEM used for mTLS.--brcac-key <path>— Path to the BRCAC client key PEM used for mTLS.--ca-bundle <path>— Optional CA bundle PEM override; Directory commands otherwise use the configured ICP-Brasil trust material.--org-id <id>— Directory organisation id used to build the SSA endpoint path.--as-id <id>— Directory Authorisation Server id used to check the registered AS record.--software-id <id>— Directory software statement id used to build the SSA endpoint path.--directory-base <url>— OPIN Directory mTLS API base; token endpoint comes from issuer discovery.--directory-client-id <id>— Directory Software Statement ClientId used to obtain the Directory token.--environment <environment>— Target environment: sandbox or prod.--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.
finnest opin directory link
Auto-fill the [opin] org/AS/software ids into finnest.toml (read-only Directory GET).
Opções
--auth-base <url>— Authorization server base URL (non-mTLS host) for the OPIN target report.--matls-auth-base <url>— Regulated mTLS authorization host base URL (matls-auth.<domain>).--realm <realm>— Authorization realm for the OPIN target report (default finnest-opin).--brcac-cert <path>— Path to the BRCAC client certificate PEM used for mTLS.--brcac-key <path>— Path to the BRCAC client key PEM used for mTLS.--ca-bundle <path>— Optional CA bundle PEM override; Directory commands otherwise use the configured ICP-Brasil trust material.--org-id <id>— Directory organisation id used to build the SSA endpoint path.--as-id <id>— Directory Authorisation Server id used to check the registered AS record.--software-id <id>— Directory software statement id used to build the SSA endpoint path.--directory-base <url>— OPIN Directory mTLS API base; token endpoint comes from issuer discovery.--directory-client-id <id>— Directory Software Statement ClientId used to obtain the Directory token.--environment <environment>— Target environment: sandbox or prod.--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.
finnest opin directory diff
Compare the registered AS record vs the deployed issuer; non-zero on drift.
Opções
--auth-base <url>— Authorization server base URL (non-mTLS host) for the OPIN target report.--matls-auth-base <url>— Regulated mTLS authorization host base URL (matls-auth.<domain>).--realm <realm>— Authorization realm for the OPIN target report (default finnest-opin).--brcac-cert <path>— Path to the BRCAC client certificate PEM used for mTLS.--brcac-key <path>— Path to the BRCAC client key PEM used for mTLS.--ca-bundle <path>— Optional CA bundle PEM override; Directory commands otherwise use the configured ICP-Brasil trust material.--org-id <id>— Directory organisation id used to build the SSA endpoint path.--as-id <id>— Directory Authorisation Server id used to check the registered AS record.--directory-base <url>— OPIN Directory mTLS API base; token endpoint comes from issuer discovery.--directory-client-id <id>— Directory Software Statement ClientId used to obtain the Directory token.--environment <environment>— Target environment: sandbox or prod.--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.
finnest opin directory certs
Certificate expiry radar; non-zero if any Active cert is expired, warn ≤30d.
Opções
--brcac-cert <path>— Path to the BRCAC client certificate PEM used for mTLS.--brcac-key <path>— Path to the BRCAC client key PEM used for mTLS.--ca-bundle <path>— Optional CA bundle PEM override; Directory commands otherwise use the configured ICP-Brasil trust material.--org-id <id>— Directory organisation id used to build the SSA endpoint path.--software-id <id>— Directory software statement id used to build the SSA endpoint path.--directory-base <url>— OPIN Directory mTLS API base; token endpoint comes from issuer discovery.--directory-client-id <id>— Directory Software Statement ClientId used to obtain the Directory token.--environment <environment>— Target environment: sandbox or prod.--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.