[Openid-specs-ab] RP Tests: ID Token signature validation for code flow
wdenniss at google.com
Mon May 1 16:54:37 UTC 2017
Sorry we didn't get a chance to talk in Chicago on this topic Mike, my trip
was all too brief. I'll be around this week though, hopefully we can
discuss this with the relevant parties.
As of yesterday, AppAuth for iOS and macOS is now passing
<https://github.com/openid/AppAuth-iOS/pull/101> all but those 4 signature
verification tests in the "code" profile. I'm preparing the certification
packet, once we have a final decision on the optionality of those tests,
I'm hoping to certify.
Incidentally, one of the cool things about how we implemented these tests
in AppAuth, is that we actually *built them into our continuous-integration
testing pipeline*. The conformance tests run alongside our unit tests for
every release, and every git push. The certification log output is
automatic too, meaning anyone can run the certification tests and produce
the same output at the click of a button.
I think this is a huge value-add for the RP certification program.
Previously we only had unit tests in the library, no end-to-end tests due
to the fact we didn't have an OP with interaction-less responses that we
could use for automated testing. The RP certification program has made this
available, and by using it, our test coverage is vastly improved.
Thank you Roland, Mike, the Foundation and everyone who is working on this,
it's a very valuable effort!
On Sun, Mar 26, 2017 at 1:29 PM, Mike Jones <Michael.Jones at microsoft.com>
> One thought is that this maybe should depend upon how the RP registers.
> If it registers with support for signature algorithms, then that support
> should be tested – even for response_type=code. If it registers only with
> support for “alg”: “none”, then it obviously can’t be tested then.
> My logic is that if the RP can check signatures, the OP provides a bad
> signature, and the RP doesn’t catch it, that seems like a scenario what
> shouldn’t pass certification. Let’s talk about this in person in Chicago
> this week. I’d love to hear what others think about this as well.
> -- Mike
> *From:* Openid-specs-ab [mailto:openid-specs-ab-bounces at lists.openid.net] *On
> Behalf Of *William Denniss via Openid-specs-ab
> *Sent:* Sunday, March 26, 2017 11:13 AM
> *To:* openid-specs-ab at lists.openid.net
> *Subject:* [Openid-specs-ab] RP Tests: ID Token signature validation for
> code flow
> Regarding the 'code' response type tests
> <https://rp.certification.openid.net:8080/list?profile=C>, my
> understanding is that it's not necessary to validate the ID Token signature
> as it was obtained via a HTTPS connection to the OP.
> This test follows that logic:
> However, these 4 tests assume signature validation for the code flow:
> Can they be made optional for the 'code' response type tests?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Openid-specs-ab