Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for OAuth, OIDC, redirect flows, state or nonce handling, PKCE, token exchange, refresh logic, claim mapping, and accepted login paths. Use when the user asks to trace redirects, callback parameters, scopes, state, nonce, PKCE, refresh tokens, consent, or explain how an OAuth or OIDC chain turns into accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Start a fresh conversation. Replace the highlighted placeholders.
Use competition-oauth-oidc-chain to 在 ctf-sandbox-orchestrator 已激活、已确认授权沙箱范围/节点归属/证据优先级并路由至此后，基于 [路由与范围回执] 和 [已净化 OAuth/OIDC 证据]，输出一条紧凑的登录链分析：入口、授权重定向、回调、令牌交换与最终身份接受；明确令牌持有和实际授权的区别，并标注未知项，不执行或声称复现。
Required inputs
[路由与范围回执]
[已净化 OAuth/OIDC 证据]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: competition-oauth-oidc-chaindescription: Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for OAuth, OIDC, redirect flows, state or nonce handling, PKCE, token exchange, refresh logic, claim mapping, and accepted login paths. Use when the user asks to trace redirects, callback parameters, scopes, state, nonce, PKCE, refresh tokens, consent, or explain how an OAuth or OIDC chain turns into accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Competition OAuth OIDC Chain
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the hard part is proving how an OAuth or OIDC flow is shaped, exchanged, and ultimately accepted.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
Map the auth chain in order: entry route, redirect, authorize request, callback, token exchange, refresh, and final accepting service.
Record scopes, state, nonce, PKCE material, redirect URIs, and claim-bearing tokens before mutating anything.
Separate token possession from actual identity acceptance.
Keep browser-visible redirects and backend-visible token exchange in one compact chain.
Reproduce the smallest redirect-to-acceptance flow that proves the decisive identity edge.
Workflow
1. Map The Redirect And Token Path
Record issuer, client ID, redirect URI, authorize parameters, callback parameters, token endpoint, and refresh path.
Note which values are user-controlled, derived, cached, or validated: state, nonce, PKCE verifier, audience, scope, or prompt.
Keep browser redirects, server-side exchanges, and resulting session state tied together.
2. Prove Token-To-Identity Acceptance
Show how code, ID token, access token, or refresh token turns into app session, claims mapping, tenant selection, or accepted privilege.
Record token claims, expiration, audience, subject, scopes, and the exact accepting app or backend edge.
Distinguish UI login success from backend authorization success.
3. Reduce To The Decisive OAuth Chain
Compress the result to the smallest sequence: entry request -> redirect -> callback -> token or claim acceptance -> resulting capability.
Keep one canonical good flow and one minimal mutated flow if a parameter change matters.
If the task broadens into generic web routing or storage behavior outside the auth chain, switch back to the broader web-runtime skill.
Read This Reference
Load references/oauth-oidc-chain.md for the redirect checklist, token checklist, and evidence packaging.
If the hard part is JWT header parsing, claim normalization, key lookup, or token validation confusion after issuance, prefer $competition-jwt-claim-confusion.
What To Preserve
Redirect URIs, parameters, codes, token claims, scopes, and the accepting service or callback
The exact point where claims or tokens become accepted app identity
One minimal replayable redirect-to-acceptance sequence