[Openid-specs-ab] Issue #144: OP-Response-id_token+token registering response_types "id_token", "token" instead of "id_token token" (openid/certification)
Garyl Erickson
issues-reply at bitbucket.org
Wed Apr 8 18:28:36 UTC 2015
New issue 144: OP-Response-id_token+token registering response_types "id_token", "token" instead of "id_token token"
https://bitbucket.org/openid/certification/issue/144/op-response-id_token-token-registering
Garyl Erickson:
The OP-Response-id_token+token test is registering "response_types": ["id_token", "token"] instead of ["id_token token"], so the authorization request with response_type=id_token+token fails with an unsupported_response_type error.
```
#!bash
Test info
Profile: {'openid-configuration': 'config', 'response_type': 'id_token+token', 'crypto': 'sign', 'registration': 'dynamic'}
Timestamp: 2015-04-08T18:19:35Z
Test description: Request with response_type=id_token token [Implicit]
Test ID: OP-Response-id_token+token
Issuer: https://oidcp.openrock.org:8043/openam/oauth2
Test output
__RegistrationRequest:post__
[check]
status: INFORMATION
description: Registration Response
info: {"application_type":"web","default_max_age_enabled":true,"redirect_uris":["https://op.certification.openid.net:60052/authz_cb"],"post_logout_redirect_uris":["https://op.certification.openid.net:60052/logout"],"default_max_age":3600,"registration_client_uri":"https://oidcp.openrock.org:8043/openam/oauth2/connect/register?client_id=784ad335-3b41-4262-887a-af819a843d1a","contacts":["roland.hedberg at umu.se"],"scopes":["phone","address","email","openid","profile"],"client_secret":"0b5241ab-4801-4d85-abab-50c26e8164bb","client_type":"Confidential","registration_access_token":"215b481b-a05d-4a49-8ef7-c8d92d89b649","subject_type":"Public","id_token_signed_response_alg":"HS256","client_id_issued_at":1428517297,"client_id":"784ad335-3b41-4262-887a-af819a843d1a","client_secret_expires_at":0,"response_types":["id_token","token"]}
__AuthorizationRequest:pre__
[check-response-type]
status: OK
description: Checks that the asked for response type are among the supported
[check-endpoint]
status: OK
description: Checks that the necessary endpoint exists at a server
__After completing the test flow:__
[verify-authn-response]
status: ERROR
description: Checks that the last response was a JSON encoded authentication message
info: Expected an authorization response
__X:==== END ====__
Trace output
0.000354 ------------ DiscoveryRequest ------------
0.000366 Provider info discover from 'https://oidcp.openrock.org:8043/openam/oauth2'
0.000373 --> URL: https://oidcp.openrock.org:8043/openam/oauth2/.well-known/openid-configuration
0.474129 ProviderConfigurationResponse: {
"acr_values_supported": [
"3",
"1"
],
"authorization_endpoint": "https://oidcp.openrock.org:8043/openam/oauth2/authorize",
"check_session_iframe": "https://oidcp.openrock.org:8043/openam/oauth2/connect/checkSession",
"claims_parameter_supported": false,
"claims_supported": [
"zoneinfo",
"phone_number",
"address",
"email",
"name",
"locale",
"family_name",
"given_name"
],
"end_session_endpoint": "https://oidcp.openrock.org:8043/openam/oauth2/connect/endSession",
"grant_types_supported": [
"authorization_code",
"implicit"
],
"id_token_signing_alg_values_supported": [
"HS256",
"HS512",
"RS256",
"HS384"
],
"issuer": "https://oidcp.openrock.org:8043/openam/oauth2",
"jwks_uri": "https://oidcp.openrock.org:8043/openam/oauth2/connect/jwk_uri",
"registration_endpoint": "https://oidcp.openrock.org:8043/openam/oauth2/connect/register",
"request_parameter_supported": false,
"request_uri_parameter_supported": true,
"require_request_uri_registration": true,
"response_types_supported": [
"token id_token",
"code token",
"code token id_token",
"token",
"code id_token",
"code",
"id_token"
],
"scopes_supported": [
"phone",
"address",
"email",
"openid",
"profile"
],
"subject_types_supported": [
"public"
],
"token_endpoint": "https://oidcp.openrock.org:8043/openam/oauth2/access_token",
"token_endpoint_auth_methods_supported": [
"client_secret_basic"
],
"userinfo_endpoint": "https://oidcp.openrock.org:8043/openam/oauth2/userinfo",
"version": "3.0"
}
0.940221 JWKS: {
"keys": [
{
"alg": "RS256",
"e": "AQAB",
"kid": "571c1728-2eef-434d-8a7d-9405da6e4065",
"kty": "RSA",
"n": "AK0kHP1O-RgdgLSoWxkuaYoi5Jic6hLKeuKw8WzCfsQ68ntBDf6tVOTn_kZA7Gjf4oJAL1dXLlxIEy-kZWnxT3FF-0MQ4WQYbGBfaW8LTM4uAOLLvYZ8SIVEXmxhJsSlvaiTWCbNFaOfiII8bhFp4551YB07NfpquUGEwOxOmci_",
"use": "sig"
}
]
}
0.941207 ------------ RegistrationRequest ------------
0.941579 --> URL: https://oidcp.openrock.org:8043/openam/oauth2/connect/register
0.941586 --> BODY: {"subject_type": "public", "jwks_uri": "https://op.certification.openid.net:60052/export/jwk_60052.json", "contacts": ["roland.hedberg at umu.se"], "application_type": "web", "grant_types": ["implicit"], "post_logout_redirect_uris": ["https://op.certification.openid.net:60052/logout"], "redirect_uris": ["https://op.certification.openid.net:60052/authz_cb"], "response_types": ["id_token", "token"], "require_auth_time": true, "default_max_age": 3600}
0.941596 --> HEADERS: {'Content-type': 'application/json'}
1.445703 <-- STATUS: 201
1.445742 <-- BODY: {"application_type":"web","default_max_age_enabled":true,"redirect_uris":["https://op.certification.openid.net:60052/authz_cb"],"post_logout_redirect_uris":["https://op.certification.openid.net:60052/logout"],"default_max_age":3600,"registration_client_uri":"https://oidcp.openrock.org:8043/openam/oauth2/connect/register?client_id=784ad335-3b41-4262-887a-af819a843d1a","contacts":["roland.hedberg at umu.se"],"scopes":["phone","address","email","openid","profile"],"client_secret":"0b5241ab-4801-4d85-abab-50c26e8164bb","client_type":"Confidential","registration_access_token":"215b481b-a05d-4a49-8ef7-c8d92d89b649","subject_type":"Public","id_token_signed_response_alg":"HS256","client_id_issued_at":1428517297,"client_id":"784ad335-3b41-4262-887a-af819a843d1a","client_secret_expires_at":0,"response_types":["id_token","token"]}
1.446376 RegistrationResponse: {
"application_type": "web",
"client_id": "784ad335-3b41-4262-887a-af819a843d1a",
"client_id_issued_at": 1428517297,
"client_secret": "0b5241ab-4801-4d85-abab-50c26e8164bb",
"client_secret_expires_at": 0,
"client_type": "Confidential",
"contacts": [
"roland.hedberg at umu.se"
],
"default_max_age": 3600,
"default_max_age_enabled": true,
"id_token_signed_response_alg": "HS256",
"post_logout_redirect_uris": [
"https://op.certification.openid.net:60052/logout"
],
"redirect_uris": [
"https://op.certification.openid.net:60052/authz_cb"
],
"registration_access_token": "215b481b-a05d-4a49-8ef7-c8d92d89b649",
"registration_client_uri": "https://oidcp.openrock.org:8043/openam/oauth2/connect/register?client_id=784ad335-3b41-4262-887a-af819a843d1a",
"response_types": [
"id_token",
"token"
],
"scopes": [
"phone",
"address",
"email",
"openid",
"profile"
],
"subject_type": "Public"
}
1.448060 ------------ AuthorizationRequest ------------
1.448462 --> URL: https://oidcp.openrock.org:8043/openam/oauth2/authorize?nonce=WxQUUm1SHBmI&state=dtj5E2yHs0xfx3i0&redirect_uri=https%3A%2F%2Fop.certification.openid.net%3A60052%2Fauthz_cb&response_type=id_token+token&client_id=784ad335-3b41-4262-887a-af819a843d1a&scope=openid
1.448469 --> BODY: None
2.534865 QUERY_STRING:
3.177994 <-- error=unsupported_response_type&state=dtj5E2yHs0xfx3i0&error_description=Client does not support this response type.
3.178294 AuthorizationErrorResponse: {
"error": "unsupported_response_type",
"error_description": "Client does not support this response type.",
"state": "dtj5E2yHs0xfx3i0"
}
3.178587 ==== END ====
Result
FAILED
```
Responsible: Rohe
More information about the Openid-specs-ab
mailing list