Openid Foundation Certification

February 21, 2024 · View on GitHub

This repository contains support materials for conformance testing and certification.

The certification is funded as an Erlang Ecosystem Foundation stipend entered by the Security Working Group.

Files

/submitted_certifications/Erlang_Ecosystem_Foundation-oidcc-[PROFILE]-[DATE].zip - Finalized Certification

Conformance Testing

Setup

Register on https://www.certification.openid.net/
Create Testplan https://www.certification.openid.net/schedule-test.html

Conformance Profiles to Test

OpenID Connect Core: Basic Certification Profile Relying Party Tests

Relevant for Certification: Yes
Id: oidcc-client-basic-certification-test-plan
Request Type: plain_http_request
Client Registration Type: dynamic_client

OpenID Connect Core Client Tests: Comprehensive client test

Relevant for Certification: No
Expected Failures
- oidcc-client-test-discovery-webfinger-acct - WebFinger is not supported
- oidcc-client-test-discovery-webfinger-url - Webfinger is not supported
Id: oidcc-client-test-plan
Client Authentication Type: client_secret_post
Request Type: plain_http_request
Response Type: code
Client Registration Type: dynamic_client
Response Mode: default

OpenID Connect Core Client Refresh Token Profile Tests: Relying party refresh token tests

Relevant for Certification: No
Id: oidcc-client-refreshtoken-test-plan
Client Authentication Type: client_secret_basic
Request Type: plain_http_request
Response Type: code
Client Registration Type: dynamic_client
Response Mode: form_post

OpenID Connect Core: Form Post Basic Certification Profile Relying Party Tests

Relevant for Certification: Yes
Id: oidcc-client-formpost-basic-certification-test-plan
Request Type: plain_http_request
Client Registration Type: dynamic_client

OpenID Connect Core: Configuration Certification Profile Relying Party Tests

Relevant for Certification: Yes
Id: oidcc-client-config-certification-test-plan
Client Authentication Type: client_secret_basic
Request Type: plain_http_request
Response Mode: default
Client Registration Type: dynamic_client

Relevant for Certification: Yes
Id: oidcc-client-test-3rd-party-init-login-test-plan
Client Authentication Type: client_secret_basic
Request Type: plain_http_request
Response Mode: default
Client Registration Type: dynamic_client

How to Execute the tests

Setup

mix deps.get

Optionally, you can mount the certification branch in your worktree:

git worktree add \
  --track \
  -b openid-foundation-certification \
  certification \
  origin/openid-foundation-certification

Run

Open Plan / Specific Test

Execute the Conformance runner:

mix run_certification \
  --profile [PROFILE_NAME] \
  --test-name [TEST_NAME] \
  --alias [ALIAS] \ # Alias in www.certification.openid.net; Default "test"
  --version [VERSION] \ # Version to file Result artifacts for; Default "dev"
  --[no-]register-client \ # Run Client Registration; Default true; Disable for config only tests
  --[no-]start-server \ # Run Web Server; Default true; Disable for config / client only tests
  --[no-]auto-stop \ # Auto Stop when result is received; Default true; Disable for tests with multiple actions
  --[no-]auto-open \ # Auto open browser; Default false; Requires `xdg-open`
  --[no-]auto-screenshot \ # Auto screenshot window; Default false; Requires `gnome-screenshot` & `optipng`
  --token-endpoint-auth-method \ # Registration token_endpoint_auth_method; Default "client_secret_basic"

Open http://localhost:4000/authorize in your Browser (or auto-open)
Follow Test Protocol
Test should pass
Upload Screenshot to Test Protocol

Package Certification

After all tests have completed, prepare the publication.

Create Certification of Conformance.pdf in test_plans/[VERSION]/[PROFILE]

Package Client Data

mix package_client_data \
  --version [VERSION] \
  --profile [PROFILE]

Upload signed Certification of Conformance and test_plans/[VERSION]/[PROFILE]/client-data.zip via Publish for certification in certification.openid.net / Plan
File downloaded .zip as /submitted_certifications/Erlang_Ecosystem_Foundation-oidcc-[PROFILE]-[DATE].zip
Commit & Push File into PR
Once merged, fill out the certification request form.