Test detail

Test Name	fapi1-advanced-final-ensure-request-object-with-multiple-aud-succeeds
Variant	client_auth_type=mtls, fapi_auth_request_method=by_value, fapi_profile=plain_fapi, fapi_response_mode=jarm
Test ID	l32I7w1GMXqo87L https://www.certification.openid.net/log-detail.html?public=true&log=l32I7w1GMXqo87L
Created	2021-07-01T15:28:08.245534Z
Description
Test Version	4.1.17
Test Owner	117741858675383745996 https://accounts.google.com
Plan ID	lT7gohjbBnw7G https://www.certification.openid.net/plan-detail.html?public=true&plan=lT7gohjbBnw7G
Exported From	https://www.certification.openid.net
Exported By	117741858675383745996 https://accounts.google.com
Suite Version	4.1.17
Exported	2021-07-01 15:33:27 (UTC)

2021-07-01 15:28:08

(7) More

INFO

TEST-RUNNER

Test instance l32I7w1GMXqo87L created

baseUrl	https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm
variant	{ "client_auth_type": "mtls", "fapi_auth_request_method": "by_value", "fapi_profile": "plain_fapi", "fapi_response_mode": "jarm" }
alias	oidc-provider-by_value-mtls-plain_fapi-jarm
description
planId	lT7gohjbBnw7G
config	{ "alias": "oidc-provider-by_value-mtls-plain_fapi-jarm", "automated_ciba_approval_url": "https://fapi.panva.cz/ciba-sim?authReqId\u003d{auth_req_id}\u0026action\u003d{action}", "server": { "discoveryUrl": "https://fapi.panva.cz/.well-known/openid-configuration" }, "client": { "client_id": "mtls-one", "client_name": "mtls-one", "scope": "openid offline_access", "jwks": { "keys": [ { "e": "AQAB", "n": "xBJ1vPOR6ftkO5figrSjzsHzyFTiyrIYMoFiAFwvM-UypwNTfamwdgb6Q6VlCnV62Lgc1nDR_zx8Kyb1-NgBxnlwmSQ0l87kR_d-P34zEB0xSarqD-K84lJUSX0_qcCXLr4MYBiyOcYMzag-4GWaf_S1ZuTnV1NaaEL4lHpfocFeXok9a9XznuSzol5C8Kd5AS5ahq7UTxSCGvttKpL5xYeWXJ0Zjpptr3AJyOzmjXNq0ix1W75BbmPJjBMfK7bYatHUMsstVHLnYt3CwiNsfD8dKkBVKlh-C4DWo-1WY5VNTTxPC47Ejy2rGbDLJ9MLdtn6Pr-WyW2mdzd0EKjNFQ", "d": "quAXoet3373KFbGBoz2AgOFA7vcji1j4g5OEcCHmtUhrA2h_q8Vl1wavtqJ-00WdISAbabt7GACDiivzM8I0kd8mBSCrgR26jwmfCgCWydVXLgd44w1MZcUwVbeE8xC38PGJ4XnEYVs7r0OQQInrwtXl_d1BzDYFVVYAQ43-p_1SGASfHv052IJjPKgePFoeheT1xVNS1fCZTSWmFEVPXhbY_LQpnm8DwkR5-hmX-oSjjaJHQoHh4OP8uJ25YAwoMs3-7QOardbEu_DsseeWoQ1MRjnovDWxsxCWa-XTMIPrwF4zP4y-WbtVFILFH7e5fo2WLd5vYSxjOJkiW3TSJQ", "p": "4ZNvp0u6vXQAf7IGESuhu3u4cD6K8iJ6BT-O64yHJzc17e9lt-p89GasTtkgeEH_lr-XxScVBYndi_8vaqsA47bkIoWVvcXq7C4jkv0bPelpaI_KPGfoZC1etR102-dS1ZufxzwSo64drw-HPuwaIkXvmpK4MBI9jEYoOHh9KR8", "q": "3oRU_iCWvKOGHlR9BmcBysVGmkvBwj8XLTJGfxJkm3M9utLSg0uNo7vW0Zm88KdzdeaRBt6ltZAG3hBL0mHNwC0hYRv5fzO7yczWFLPXbUNVqC5OLI-wTL7-ikx040lL9IRRtgub47-9IvxxaGaIRzsFwa-15D7TCE7K8BydH0s", "dp": "ivnkC2VL2tcyS3op5MBF95Vk77qIrl9xX_RloFfHGPEaB8q7l5EfhRAQzs9VAuJejsjhv7SxbeUfmtYQp55NgP44FdDJjc73SqWugyvvcbhxmdslFQxLkBSnydwpGCav0Sz9RqmLLk7iuO1PPQQHoeAGm-wTEILcaqT6uLf7HK8", "dq": "TpZaFi6YTiNKuOeKCHrUzTKDTvc2hU4W92VsNHDgi25V_Od8ZdaHPa6Xngs4CZ56TseRrOVxjQBDDKagwLq-GgNWaJ-irGQvDISFj2Y8zWAcnntMLLzKvTAvYdTC64r1gnRBD5RmCDetqu-RdhfQRaf4zoEqMmRlz-dUER1p-KU", "qi": "ITLsaxLewCPcaJOYKRW9HeApKVIqYlQuYj7wShPq3NiEy_KqgIc-2WXYMfMF6oDoiXYMrP6AVsqWfb4us9StvauAr17yp1kf1ffpazy71gD9VqwZBFQUgBwVw1agEFfv2cFD_z3Os-5to3ZGH0Eq5QQYsoDMN_UkjOx5SvyN2_A", "kty": "RSA", "kid": "rxZogVFbs1tz36D4tmlW0yEHUTfD_mxyF3RSWBe5eHI", "alg": "PS256", "use": "sig", "x5c": [ "MIIC4DCCAcgCCQDuBF1vmG5mlDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwHhcNMTkwNjE4MTIzMTA2WhcNMjAwNjE3MTIzMTA2WjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFGKYDieCWZ63Fx9jMhtlPlHUgkR6bmKqGwvZuVAe9Zz+sHvbVtTk/4AEOjSozksxf070O1PnK3zY0SuZynhKJnTaFouN45iMnnNQS6XMKd9Tm5WpSRbxfaOeuIZybvOmNy0nuxkvqcE5fXIyr9bDCO9WEArQIQqjGJ93zKJpV2nT9Q7heTK430z7Hp3+XxwGXoKsLW/jebr3ryWTMEv8ouEbXeCz2OH6Oup8UIwXDyjYxwhwS5FAcRQdh4KnhHOLGYVAuVR3wPewtrTioYznFdfwtDHGd9fZVxrXPlVqCksj0CTnPf7UgXtjm2hTfkwHHtW2BegWR/q3+q9gs7uehc\u003d" ], "x5t#S256": "E-TFTHXRZVsBSvZ5p5mc7ZZMle2Urpv9yr9PdGcOqXQ" } ] }, "hint_type": "login_hint", "hint_value": "panva" }, "mtls": { "cert": "-----BEGIN CERTIFICATE-----\nMIIC4DCCAcgCCQDuBF1vmG5mlDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJD\nWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwHhcNMTkwNjE4\nMTIzMTA2WhcNMjAwNjE3MTIzMTA2WjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwG\nUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwggEiMA0GCSqGSIb3DQEBAQUAA4IB\nDwAwggEKAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9\nqbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP\n4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r\n1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVb\nvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8L\njsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAEwDQYJKoZIhvcNAQELBQAD\nggEBAFGKYDieCWZ63Fx9jMhtlPlHUgkR6bmKqGwvZuVAe9Zz+sHvbVtTk/4AEOjS\nozksxf070O1PnK3zY0SuZynhKJnTaFouN45iMnnNQS6XMKd9Tm5WpSRbxfaOeuIZ\nybvOmNy0nuxkvqcE5fXIyr9bDCO9WEArQIQqjGJ93zKJpV2nT9Q7heTK430z7Hp3\n+XxwGXoKsLW/jebr3ryWTMEv8ouEbXeCz2OH6Oup8UIwXDyjYxwhwS5FAcRQdh4K\nnhHOLGYVAuVR3wPewtrTioYznFdfwtDHGd9fZVxrXPlVqCksj0CTnPf7UgXtjm2h\nTfkwHHtW2BegWR/q3+q9gs7uehc\u003d\n-----END CERTIFICATE-----\n", "key": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDEEnW885Hp+2Q7\nl+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwr\nJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzN\nqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa\n+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi\n3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3\nN3QQqM0VAgMBAAECggEBAKrgF6Hrd9+9yhWxgaM9gIDhQO73I4tY+IOThHAh5rVI\nawNof6vFZdcGr7aiftNFnSEgG2m7exgAg4or8zPCNJHfJgUgq4Eduo8JnwoAlsnV\nVy4HeOMNTGXFMFW3hPMQt/DxieF5xGFbO69DkECJ68LV5f3dQcw2BVVWAEON/qf9\nUhgEnx79OdiCYzyoHjxaHoXk9cVTUtXwmU0lphRFT14W2Py0KZ5vA8JEefoZl/qE\no42iR0KB4eDj/LiduWAMKDLN/u0Dmq3WxLvw7LHnlqENTEY56Lw1sbMQlmvl0zCD\n68BeMz+Mvlm7VRSCxR+3uX6Nli3eb2EsYziZIlt00iUCgYEA4ZNvp0u6vXQAf7IG\nESuhu3u4cD6K8iJ6BT+O64yHJzc17e9lt+p89GasTtkgeEH/lr+XxScVBYndi/8v\naqsA47bkIoWVvcXq7C4jkv0bPelpaI/KPGfoZC1etR102+dS1ZufxzwSo64drw+H\nPuwaIkXvmpK4MBI9jEYoOHh9KR8CgYEA3oRU/iCWvKOGHlR9BmcBysVGmkvBwj8X\nLTJGfxJkm3M9utLSg0uNo7vW0Zm88KdzdeaRBt6ltZAG3hBL0mHNwC0hYRv5fzO7\nyczWFLPXbUNVqC5OLI+wTL7+ikx040lL9IRRtgub47+9IvxxaGaIRzsFwa+15D7T\nCE7K8BydH0sCgYEAivnkC2VL2tcyS3op5MBF95Vk77qIrl9xX/RloFfHGPEaB8q7\nl5EfhRAQzs9VAuJejsjhv7SxbeUfmtYQp55NgP44FdDJjc73SqWugyvvcbhxmdsl\nFQxLkBSnydwpGCav0Sz9RqmLLk7iuO1PPQQHoeAGm+wTEILcaqT6uLf7HK8CgYBO\nlloWLphOI0q454oIetTNMoNO9zaFThb3ZWw0cOCLblX853xl1oc9rpeeCzgJnnpO\nx5Gs5XGNAEMMpqDAur4aA1Zon6KsZC8MhIWPZjzNYByee0wsvMq9MC9h1MLrivWC\ndEEPlGYIN62q75F2F9BFp/jOgSoyZGXP51QRHWn4pQKBgCEy7GsS3sAj3GiTmCkV\nvR3gKSlSKmJULmI+8EoT6tzYhMvyqoCHPtll2DHzBeqA6Il2DKz+gFbKln2+LrPU\nrb2rgK9e8qdZH9X36Ws8u9YA/VasGQRUFIAcFcNWoBBX79nBQ/89zrPubaN2Rh9B\nKuUEGLKAzDf1JIzseUr8jdvw\n-----END PRIVATE KEY-----\n" }, "client2": { "client_id": "mtls-two", "client_name": "mtls-two", "scope": "openid offline_access", "jwks": { "keys": [ { "e": "AQAB", "n": "4alQGjLL5whE8w7SsHysWQtY8CDoSMlKfMaftqDfqScLaj9FKZC5U1ezA_eB2Ui9593_YbBumqaUUBhgCdk4TsNTfc5QK-0pPWB-hrbt22Eg70usGio1aMRq65i38rqBG79zw6jFrjoxNzE_xtZ8FAYCBCmAK_IYs2PHVBNGdqlryhWSY-nrYwlxKaY17sJUrrB1sP7Y_3jzDMTACTDz4cyXoegC-4lCgYrCcrD7mlq0vZ7XT8b_T0uNLL-nGU-MKMZhOraUwpAMWm16gNuUoCTsijo574PgTzZa7nC6h8NxK1q8WEy_fXB6oXsTuiuBWrKVt_tZLlnd32OApvs5Ew", "d": "SlRt2SNQPJphs7n3NkDquC3frsD4IjmDepQmOY7F_T6qKOYMTwOnt8cUZUMal0q5mu1p2HC4DeK-yZ8tyzCstmzqTG8vwzhMNDZblt4cfP2CTrAbUUcD7q18FnxoYuCB9HTcmd82tgve-DIVstYlaqcL9PkCifcloblFB_GNbToEdiHqRNbHvVZLMYGYsShkiyFVL61h5zkFgQCBv-kR5u3AWGGGtlhZ3dvU7-i0P7n4dKseQyyd9v_QcW4iW8b3f6izn4plQNcPbb4o0iAdhpnjYxCOwxc8TGZvHul_RYnlFGuiKUXSV_r_t_dEppsKM4moJ8n6qzsoZf6czR5NwQ", "p": "_supybPbDRLiAWtiYxGSGIVV41UTvV5LrKjd2qCslOPF_iYOP1wyTFOjUWjBHWqaaPCYMpK4NIdnDUuCQ5K8Nz8FaIWkdUksDXJYO3FZR-dBzulkyKwNZQE-1VwT7MYlIih695zaYdtnIRw0cN6oYW5bheDYdE13SzcLK3XGMqE", "q": "4rpkthJwjk-brxKVuDIxUVXiwbArdbQLn1UXBdl54Mn4C5ntMy50BofGaqxx6WZoGUATNwD5w7Sf1KsxCMIObLr6xNVNpUnI766VaV69WYiFdB3N8BBi3L4Jmb1hLXIyX2WITTHY2w5UKOYwD6pKCa5FldqArm5slJCpmtffQzM", "dp": "ApnXoNx6JvcDYZpUBcjfIeryhoCO1AcLZLbQlPPA70An_EEtMg5h4Q-VgjY8im1VKC8Ujqeaw8aCEcush74Ot82n43pBxIS7s2NwbSLqE2bT8CXHxpijBl3t40WuWmNna6LYJoDuZcNUmSztiB1twJjczFAQRZeo2Ra1wXrRTCE", "dq": "jpFaZsrtj-8rHEl5b9vP-y8gaV7X1Smj7UraMUlxRBJ8MP9Xkklxl_GkqMtKzdMhPk92Ra4NYCyiHF6RdMphu6lPqpneO0NMYLrNJPb35ebc1Akxx_Tl1ZyB-PSGuMcIOchkjvX7QLOf5B_qtM8Fw1ScWQCOziCNklXs8Hsx3tU", "qi": "Z_CBJI5NGWkGZjkLM4fqq8U2hFM9Y5IHsn9Y8vvst3-mCqcFhTS7TcYUY00qdiFXAJjiwhfGFOoc0q-AWluiUxB-b6FWRu73XhqkKxgBehE9i3QCrcitMufSkXKydLonfh7_PeUpB63LmMjtyLdMlGAIorVbtD1xAn2WaYuEb5Q", "kty": "RSA", "kid": "LJuZnTrnhtSbpcjnu4pq3Xvrmzy6sI_fUOd7L7Bh9to", "alg": "PS256", "use": "sig", "x5c": [ "MIIC4DCCAcgCCQDO8JBSH914NDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wHhcNMTkwNjE4MTIzMjAxWhcNMjAwNjE3MTIzMjAxWjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhqVAaMsvnCETzDtKwfKxZC1jwIOhIyUp8xp+2oN+pJwtqP0UpkLlTV7MD94HZSL3n3f9hsG6appRQGGAJ2ThOw1N9zlAr7Sk9YH6Gtu3bYSDvS6waKjVoxGrrmLfyuoEbv3PDqMWuOjE3MT/G1nwUBgIEKYAr8hizY8dUE0Z2qWvKFZJj6etjCXEppjXuwlSusHWw/tj/ePMMxMAJMPPhzJeh6AL7iUKBisJysPuaWrS9ntdPxv9PS40sv6cZT4woxmE6tpTCkAxabXqA25SgJOyKOjnvg+BPNlrucLqHw3ErWrxYTL99cHqhexO6K4FaspW3+1kuWd3fY4Cm+zkTAgMBAAEwDQYJKoZIhvcNAQELBQADggEBALsB6MGWke5vS1TB3Z+NJkC29bEIb3XGC9WaxRovH0jqaaua2AfAF7VZzUyWS/+r6hvWOtqUVy7YF1ThnEJXuXJG9ra2B2+F5RYNCtrVj6Bi+zDTSJ4IvQfrF0XBKwwOdRu7VJpAxvweA/3woKl6Cjfy20ZupPH9mxr1R78BMKgEtdFsiLwbB7MOdDbTLsrUcEcupXv+gZek22upQKrAk/XFP067KIqKmCEhDidxhP251SloUaruv9cHEx0aDKol9eR465FAiBLvg2N7qJHCKlWdn99SgN4Y3kINsuFR7Tj4QIJZNubOjV0YeOgnAWzRJlZD89KZAQgjj4Z215QeLxA\u003d" ], "x5t#S256": "B_QzvtQ9biL043xj_ADE7e9MUdWwbdAr3W3W7JHbK9c" } ] }, "acr_value": "urn:mace:incommon:iap:silver" }, "mtls2": { "cert": "-----BEGIN CERTIFICATE-----\nMIIC4DCCAcgCCQDO8JBSH914NDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJD\nWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wHhcNMTkwNjE4\nMTIzMjAxWhcNMjAwNjE3MTIzMjAxWjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwG\nUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wggEiMA0GCSqGSIb3DQEBAQUAA4IB\nDwAwggEKAoIBAQDhqVAaMsvnCETzDtKwfKxZC1jwIOhIyUp8xp+2oN+pJwtqP0Up\nkLlTV7MD94HZSL3n3f9hsG6appRQGGAJ2ThOw1N9zlAr7Sk9YH6Gtu3bYSDvS6wa\nKjVoxGrrmLfyuoEbv3PDqMWuOjE3MT/G1nwUBgIEKYAr8hizY8dUE0Z2qWvKFZJj\n6etjCXEppjXuwlSusHWw/tj/ePMMxMAJMPPhzJeh6AL7iUKBisJysPuaWrS9ntdP\nxv9PS40sv6cZT4woxmE6tpTCkAxabXqA25SgJOyKOjnvg+BPNlrucLqHw3ErWrxY\nTL99cHqhexO6K4FaspW3+1kuWd3fY4Cm+zkTAgMBAAEwDQYJKoZIhvcNAQELBQAD\nggEBALsB6MGWke5vS1TB3Z+NJkC29bEIb3XGC9WaxRovH0jqaaua2AfAF7VZzUyW\nS/+r6hvWOtqUVy7YF1ThnEJXuXJG9ra2B2+F5RYNCtrVj6Bi+zDTSJ4IvQfrF0XB\nKwwOdRu7VJpAxvweA/3woKl6Cjfy20ZupPH9mxr1R78BMKgEtdFsiLwbB7MOdDbT\nLsrUcEcupXv+gZek22upQKrAk/XFP067KIqKmCEhDidxhP251SloUaruv9cHEx0a\nDKol9eR465FAiBLvg2N7qJHCKlWdn99SgN4Y3kINsuFR7Tj4QIJZNubOjV0YeOgn\nAWzRJlZD89KZAQgjj4Z215QeLxA\u003d\n-----END CERTIFICATE-----\n", "key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDhqVAaMsvnCETz\nDtKwfKxZC1jwIOhIyUp8xp+2oN+pJwtqP0UpkLlTV7MD94HZSL3n3f9hsG6appRQ\nGGAJ2ThOw1N9zlAr7Sk9YH6Gtu3bYSDvS6waKjVoxGrrmLfyuoEbv3PDqMWuOjE3\nMT/G1nwUBgIEKYAr8hizY8dUE0Z2qWvKFZJj6etjCXEppjXuwlSusHWw/tj/ePMM\nxMAJMPPhzJeh6AL7iUKBisJysPuaWrS9ntdPxv9PS40sv6cZT4woxmE6tpTCkAxa\nbXqA25SgJOyKOjnvg+BPNlrucLqHw3ErWrxYTL99cHqhexO6K4FaspW3+1kuWd3f\nY4Cm+zkTAgMBAAECggEASlRt2SNQPJphs7n3NkDquC3frsD4IjmDepQmOY7F/T6q\nKOYMTwOnt8cUZUMal0q5mu1p2HC4DeK+yZ8tyzCstmzqTG8vwzhMNDZblt4cfP2C\nTrAbUUcD7q18FnxoYuCB9HTcmd82tgve+DIVstYlaqcL9PkCifcloblFB/GNbToE\ndiHqRNbHvVZLMYGYsShkiyFVL61h5zkFgQCBv+kR5u3AWGGGtlhZ3dvU7+i0P7n4\ndKseQyyd9v/QcW4iW8b3f6izn4plQNcPbb4o0iAdhpnjYxCOwxc8TGZvHul/RYnl\nFGuiKUXSV/r/t/dEppsKM4moJ8n6qzsoZf6czR5NwQKBgQD+y6nJs9sNEuIBa2Jj\nEZIYhVXjVRO9XkusqN3aoKyU48X+Jg4/XDJMU6NRaMEdappo8Jgykrg0h2cNS4JD\nkrw3PwVohaR1SSwNclg7cVlH50HO6WTIrA1lAT7VXBPsxiUiKHr3nNph22chHDRw\n3qhhbluF4Nh0TXdLNwsrdcYyoQKBgQDiumS2EnCOT5uvEpW4MjFRVeLBsCt1tAuf\nVRcF2XngyfgLme0zLnQGh8ZqrHHpZmgZQBM3APnDtJ/UqzEIwg5suvrE1U2lScjv\nrpVpXr1ZiIV0Hc3wEGLcvgmZvWEtcjJfZYhNMdjbDlQo5jAPqkoJrkWV2oCubmyU\nkKma199DMwKBgAKZ16Dceib3A2GaVAXI3yHq8oaAjtQHC2S20JTzwO9AJ/xBLTIO\nYeEPlYI2PIptVSgvFI6nmsPGghHLrIe+DrfNp+N6QcSEu7NjcG0i6hNm0/Alx8aY\nowZd7eNFrlpjZ2ui2CaA7mXDVJks7YgdbcCY3MxQEEWXqNkWtcF60UwhAoGBAI6R\nWmbK7Y/vKxxJeW/bz/svIGle19Upo+1K2jFJcUQSfDD/V5JJcZfxpKjLSs3TIT5P\ndkWuDWAsohxekXTKYbupT6qZ3jtDTGC6zST29+Xm3NQJMcf05dWcgfj0hrjHCDnI\nZI71+0Czn+Qf6rTPBcNUnFkAjs4gjZJV7PB7Md7VAoGAZ/CBJI5NGWkGZjkLM4fq\nq8U2hFM9Y5IHsn9Y8vvst3+mCqcFhTS7TcYUY00qdiFXAJjiwhfGFOoc0q+AWlui\nUxB+b6FWRu73XhqkKxgBehE9i3QCrcitMufSkXKydLonfh7/PeUpB63LmMjtyLdM\nlGAIorVbtD1xAn2WaYuEb5Q\u003d\n-----END PRIVATE KEY-----\n \n" }, "resource": { "resourceUrl": "https://mtls.fapi.panva.cz/accounts", "institution_id": "xxxxx" }, "browser": [ { "match": "https://fapi.panva.cz/auth", "tasks": [ { "task": "Login", "optional": true, "match": "https://fapi.panva.cz/interaction", "commands": [ [ "text", "name", "login", "foo", "optional" ], [ "text", "name", "password", "bar", "optional" ], [ "click", "class", "login-submit" ] ] }, { "task": "Consent", "optional": true, "match": "https://fapi.panva.cz/interaction", "commands": [ [ "click", "class", "login-submit" ] ] }, { "task": "Verify Complete", "match": "https:///test/a//callback", "commands": [ [ "wait", "id", "submission_complete", 10 ] ] } ] } ] }
testName	fapi1-advanced-final-ensure-request-object-with-multiple-aud-succeeds

2021-07-01 15:28:08

(1) More

SUCCESS

CreateRedirectUri

Created redirect URI

redirect_uri

https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback

2021-07-01 15:28:08

(4) More

GetDynamicServerConfiguration

HTTP request

request_uri	https://fapi.panva.cz/.well-known/openid-configuration
request_method	GET
request_headers	{ "accept": "text/plain, application/json, application/cbor, application/+json, /*", "content-length": "0" }
request_body

2021-07-01 15:28:08

(4) More

RESPONSE

GetDynamicServerConfiguration

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "content-length": "1747", "content-security-policy": "default-src \u0027self\u0027;base-uri \u0027self\u0027;block-all-mixed-content;font-src \u0027self\u0027 https: data:;frame-ancestors \u0027self\u0027;img-src \u0027self\u0027 data:;object-src \u0027none\u0027;script-src \u0027self\u0027;script-src-attr \u0027none\u0027;style-src \u0027self\u0027 https: \u0027unsafe-inline\u0027;upgrade-insecure-requests", "content-type": "application/json; charset\u003dutf-8", "date": "Thu, 01 Jul 2021 15:28:08 GMT", "expect-ct": "max-age\u003d0", "referrer-policy": "no-referrer", "server": [ "Caddy", "Cowboy" ], "strict-transport-security": "max-age\u003d15552000; includeSubDomains", "vary": "Origin", "via": "1.1 vegur", "x-content-type-options": "nosniff", "x-dns-prefetch-control": "off", "x-download-options": "noopen", "x-frame-options": "SAMEORIGIN", "x-permitted-cross-domain-policies": "none", "x-xss-protection": "0" }
response_body	{"acr_values_supported":["urn:mace:incommon:iap:silver"],"authorization_endpoint":"https://fapi.panva.cz/auth","claims_parameter_supported":false,"claims_supported":["sub","acr","sid","auth_time","iss"],"code_challenge_methods_supported":["S256"],"end_session_endpoint":"https://fapi.panva.cz/session/end","grant_types_supported":["implicit","authorization_code","refresh_token","urn:openid:params:grant-type:ciba"],"id_token_signing_alg_values_supported":["PS256"],"issuer":"https://fapi.panva.cz","jwks_uri":"https://fapi.panva.cz/jwks","registration_endpoint":"https://fapi.panva.cz/reg","response_modes_supported":["form_post","fragment","query","jwt","query.jwt","fragment.jwt","form_post.jwt"],"response_types_supported":["code id_token","code"],"scopes_supported":["openid","offline_access"],"subject_types_supported":["public"],"token_endpoint_auth_methods_supported":["private_key_jwt","self_signed_tls_client_auth"],"token_endpoint_auth_signing_alg_values_supported":["PS256"],"token_endpoint":"https://mtls.fapi.panva.cz/token","pushed_authorization_request_endpoint":"https://mtls.fapi.panva.cz/request","request_object_signing_alg_values_supported":["PS256"],"request_parameter_supported":true,"request_uri_parameter_supported":false,"require_signed_request_object":true,"userinfo_endpoint":"https://mtls.fapi.panva.cz/accounts","authorization_signing_alg_values_supported":["PS256"],"tls_client_certificate_bound_access_tokens":true,"backchannel_authentication_endpoint":"https://mtls.fapi.panva.cz/backchannel","backchannel_token_delivery_modes_supported":["poll","ping"],"backchannel_user_code_parameter_supported":true,"backchannel_authentication_request_signing_alg_values_supported":["PS256"],"claim_types_supported":["normal"]}

2021-07-01 15:28:08

(1) More

GetDynamicServerConfiguration

Downloaded server configuration

server_config_string

{"acr_values_supported":["urn:mace:incommon:iap:silver"],"authorization_endpoint":"https://fapi.panva.cz/auth","claims_parameter_supported":false,"claims_supported":["sub","acr","sid","auth_time","iss"],"code_challenge_methods_supported":["S256"],"end_session_endpoint":"https://fapi.panva.cz/session/end","grant_types_supported":["implicit","authorization_code","refresh_token","urn:openid:params:grant-type:ciba"],"id_token_signing_alg_values_supported":["PS256"],"issuer":"https://fapi.panva.cz","jwks_uri":"https://fapi.panva.cz/jwks","registration_endpoint":"https://fapi.panva.cz/reg","response_modes_supported":["form_post","fragment","query","jwt","query.jwt","fragment.jwt","form_post.jwt"],"response_types_supported":["code id_token","code"],"scopes_supported":["openid","offline_access"],"subject_types_supported":["public"],"token_endpoint_auth_methods_supported":["private_key_jwt","self_signed_tls_client_auth"],"token_endpoint_auth_signing_alg_values_supported":["PS256"],"token_endpoint":"https://mtls.fapi.panva.cz/token","pushed_authorization_request_endpoint":"https://mtls.fapi.panva.cz/request","request_object_signing_alg_values_supported":["PS256"],"request_parameter_supported":true,"request_uri_parameter_supported":false,"require_signed_request_object":true,"userinfo_endpoint":"https://mtls.fapi.panva.cz/accounts","authorization_signing_alg_values_supported":["PS256"],"tls_client_certificate_bound_access_tokens":true,"backchannel_authentication_endpoint":"https://mtls.fapi.panva.cz/backchannel","backchannel_token_delivery_modes_supported":["poll","ping"],"backchannel_user_code_parameter_supported":true,"backchannel_authentication_request_signing_alg_values_supported":["PS256"],"claim_types_supported":["normal"]}

2021-07-01 15:28:08

(31) More

SUCCESS

GetDynamicServerConfiguration

Successfully parsed server configuration

acr_values_supported	[ "urn:mace:incommon:iap:silver" ]
authorization_endpoint	https://fapi.panva.cz/auth
claims_parameter_supported	false
claims_supported	[ "sub", "acr", "sid", "auth_time", "iss" ]
code_challenge_methods_supported	[ "S256" ]
end_session_endpoint	https://fapi.panva.cz/session/end
grant_types_supported	[ "implicit", "authorization_code", "refresh_token", "urn:openid:params:grant-type:ciba" ]
id_token_signing_alg_values_supported	[ "PS256" ]
issuer	https://fapi.panva.cz
jwks_uri	https://fapi.panva.cz/jwks
registration_endpoint	https://fapi.panva.cz/reg
response_modes_supported	[ "form_post", "fragment", "query", "jwt", "query.jwt", "fragment.jwt", "form_post.jwt" ]
response_types_supported	[ "code id_token", "code" ]
scopes_supported	[ "openid", "offline_access" ]
subject_types_supported	[ "public" ]
token_endpoint_auth_methods_supported	[ "private_key_jwt", "self_signed_tls_client_auth" ]
token_endpoint_auth_signing_alg_values_supported	[ "PS256" ]
token_endpoint	https://mtls.fapi.panva.cz/token
pushed_authorization_request_endpoint	https://mtls.fapi.panva.cz/request
request_object_signing_alg_values_supported	[ "PS256" ]
request_parameter_supported	true
request_uri_parameter_supported	false
require_signed_request_object	true
userinfo_endpoint	https://mtls.fapi.panva.cz/accounts
authorization_signing_alg_values_supported	[ "PS256" ]
tls_client_certificate_bound_access_tokens	true
backchannel_authentication_endpoint	https://mtls.fapi.panva.cz/backchannel
backchannel_token_delivery_modes_supported	[ "poll", "ping" ]
backchannel_user_code_parameter_supported	true
backchannel_authentication_request_signing_alg_values_supported	[ "PS256" ]
claim_types_supported	[ "normal" ]

2021-07-01 15:28:08		AddMTLSEndpointAliasesToEnvironment mtls_endpoint_aliases is not present in the server configuration

2021-07-01 15:28:08

(1) More

SUCCESS

CheckServerConfiguration

Found required server configuration keys

required

[
  "authorization_endpoint",
  "token_endpoint",
  "issuer"
]

2021-07-01 15:28:08

(1) More

FetchServerKeys

Fetching server key

jwks_uri

https://fapi.panva.cz/jwks

2021-07-01 15:28:08

(4) More

FetchServerKeys

HTTP request

request_uri	https://fapi.panva.cz/jwks
request_method	GET
request_headers	{ "accept": "text/plain, application/json, application/cbor, application/+json, /*", "content-length": "0" }
request_body

2021-07-01 15:28:09

(4) More

RESPONSE

FetchServerKeys

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "content-length": "462", "content-security-policy": "default-src \u0027self\u0027;base-uri \u0027self\u0027;block-all-mixed-content;font-src \u0027self\u0027 https: data:;frame-ancestors \u0027self\u0027;img-src \u0027self\u0027 data:;object-src \u0027none\u0027;script-src \u0027self\u0027;script-src-attr \u0027none\u0027;style-src \u0027self\u0027 https: \u0027unsafe-inline\u0027;upgrade-insecure-requests", "content-type": "application/jwk-set+json; charset\u003dutf-8", "date": "Thu, 01 Jul 2021 15:28:09 GMT", "expect-ct": "max-age\u003d0", "referrer-policy": "no-referrer", "server": [ "Caddy", "Cowboy" ], "strict-transport-security": "max-age\u003d15552000; includeSubDomains", "vary": "Origin", "via": "1.1 vegur", "x-content-type-options": "nosniff", "x-dns-prefetch-control": "off", "x-download-options": "noopen", "x-frame-options": "SAMEORIGIN", "x-permitted-cross-domain-policies": "none", "x-xss-protection": "0" }
response_body	{"keys":[{"kty":"RSA","use":"sig","kid":"EUsMLFwXz5zMhkJoo1lcnIM2pApLc3kc_2WV8YKYC3M","alg":"PS256","e":"AQAB","n":"sUQ6a7yX-qCAIgqYl_pzn2yK5RsPb5zjxMG1v2bvlvf6l6LyvJkxEr4dWLAbn9WAV72GuyMkvWfVi13fu4cYl2vdkIFBt0JGT40QxkMUp0izHs4RiLK1GTrwJ2qX7H67EaNNWFeE9Yqh3sIRyQgHqQf6L9rZFWBSED-M3OaiwH-zdwrMzjQH6wCEjmuyTFiNLO2QI6Yr7dDl1rPjWvN9d8pHHWxkRMAnQrL5_mfvOD_j1Tr5blXYTMHHpThOHVM2Ibe4_5YDmPaRXFMgQrPjz6mlUa9d1EL7CuxLd19S3A_6XEMB2juo0RRCfaHK7ZORPJKa36qrVZVhXK3Geuqorw"}]}

2021-07-01 15:28:09

(1) More

FetchServerKeys

Found JWK set string

jwk_string

{"keys":[{"kty":"RSA","use":"sig","kid":"EUsMLFwXz5zMhkJoo1lcnIM2pApLc3kc_2WV8YKYC3M","alg":"PS256","e":"AQAB","n":"sUQ6a7yX-qCAIgqYl_pzn2yK5RsPb5zjxMG1v2bvlvf6l6LyvJkxEr4dWLAbn9WAV72GuyMkvWfVi13fu4cYl2vdkIFBt0JGT40QxkMUp0izHs4RiLK1GTrwJ2qX7H67EaNNWFeE9Yqh3sIRyQgHqQf6L9rZFWBSED-M3OaiwH-zdwrMzjQH6wCEjmuyTFiNLO2QI6Yr7dDl1rPjWvN9d8pHHWxkRMAnQrL5_mfvOD_j1Tr5blXYTMHHpThOHVM2Ibe4_5YDmPaRXFMgQrPjz6mlUa9d1EL7CuxLd19S3A_6XEMB2juo0RRCfaHK7ZORPJKa36qrVZVhXK3Geuqorw"}]}

2021-07-01 15:28:09

(1) More

SUCCESS

FetchServerKeys

Found server JWK set

server_jwks

{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "kid": "EUsMLFwXz5zMhkJoo1lcnIM2pApLc3kc_2WV8YKYC3M",
      "alg": "PS256",
      "e": "AQAB",
      "n": "sUQ6a7yX-qCAIgqYl_pzn2yK5RsPb5zjxMG1v2bvlvf6l6LyvJkxEr4dWLAbn9WAV72GuyMkvWfVi13fu4cYl2vdkIFBt0JGT40QxkMUp0izHs4RiLK1GTrwJ2qX7H67EaNNWFeE9Yqh3sIRyQgHqQf6L9rZFWBSED-M3OaiwH-zdwrMzjQH6wCEjmuyTFiNLO2QI6Yr7dDl1rPjWvN9d8pHHWxkRMAnQrL5_mfvOD_j1Tr5blXYTMHHpThOHVM2Ibe4_5YDmPaRXFMgQrPjz6mlUa9d1EL7CuxLd19S3A_6XEMB2juo0RRCfaHK7ZORPJKa36qrVZVhXK3Geuqorw"
    }
  ]
}

2021-07-01 15:28:09

(1) More

SUCCESS

CheckServerKeysIsValid

Server JWKs is valid

server_jwks

{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "kid": "EUsMLFwXz5zMhkJoo1lcnIM2pApLc3kc_2WV8YKYC3M",
      "alg": "PS256",
      "e": "AQAB",
      "n": "sUQ6a7yX-qCAIgqYl_pzn2yK5RsPb5zjxMG1v2bvlvf6l6LyvJkxEr4dWLAbn9WAV72GuyMkvWfVi13fu4cYl2vdkIFBt0JGT40QxkMUp0izHs4RiLK1GTrwJ2qX7H67EaNNWFeE9Yqh3sIRyQgHqQf6L9rZFWBSED-M3OaiwH-zdwrMzjQH6wCEjmuyTFiNLO2QI6Yr7dDl1rPjWvN9d8pHHWxkRMAnQrL5_mfvOD_j1Tr5blXYTMHHpThOHVM2Ibe4_5YDmPaRXFMgQrPjz6mlUa9d1EL7CuxLd19S3A_6XEMB2juo0RRCfaHK7ZORPJKa36qrVZVhXK3Geuqorw"
    }
  ]
}

2021-07-01 15:28:09	SUCCESS RFC7517-1.1	ValidateServerJWKs Valid server JWKs: keys are valid JSON, contain the required fields and are correctly encoded using unpadded base64url

2021-07-01 15:28:09	SUCCESS OIDCC-10.1	CheckForKeyIdInServerJWKs All keys contain kids

2021-07-01 15:28:09	SUCCESS RFC7518-6.3.2.1	EnsureServerJwksDoesNotContainPrivateOrSymmetricKeys Jwks does not contain any private or symmetric keys

2021-07-01 15:28:09

(1) More

SUCCESS

FAPI1-BASE-5.2.2-6 FAPI1-BASE-5.2.2-5

FAPIEnsureMinimumServerKeyLength

Validated minimum key lengths for server_jwks

server_jwks

{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "kid": "EUsMLFwXz5zMhkJoo1lcnIM2pApLc3kc_2WV8YKYC3M",
      "alg": "PS256",
      "e": "AQAB",
      "n": "sUQ6a7yX-qCAIgqYl_pzn2yK5RsPb5zjxMG1v2bvlvf6l6LyvJkxEr4dWLAbn9WAV72GuyMkvWfVi13fu4cYl2vdkIFBt0JGT40QxkMUp0izHs4RiLK1GTrwJ2qX7H67EaNNWFeE9Yqh3sIRyQgHqQf6L9rZFWBSED-M3OaiwH-zdwrMzjQH6wCEjmuyTFiNLO2QI6Yr7dDl1rPjWvN9d8pHHWxkRMAnQrL5_mfvOD_j1Tr5blXYTMHHpThOHVM2Ibe4_5YDmPaRXFMgQrPjz6mlUa9d1EL7CuxLd19S3A_6XEMB2juo0RRCfaHK7ZORPJKa36qrVZVhXK3Geuqorw"
    }
  ]
}

2021-07-01 15:28:09

(6) More

SUCCESS

GetStaticClientConfiguration

Found a static client object

client_id	mtls-one
client_name	mtls-one
scope	openid offline_access
jwks	{ "keys": [ { "e": "AQAB", "n": "xBJ1vPOR6ftkO5figrSjzsHzyFTiyrIYMoFiAFwvM-UypwNTfamwdgb6Q6VlCnV62Lgc1nDR_zx8Kyb1-NgBxnlwmSQ0l87kR_d-P34zEB0xSarqD-K84lJUSX0_qcCXLr4MYBiyOcYMzag-4GWaf_S1ZuTnV1NaaEL4lHpfocFeXok9a9XznuSzol5C8Kd5AS5ahq7UTxSCGvttKpL5xYeWXJ0Zjpptr3AJyOzmjXNq0ix1W75BbmPJjBMfK7bYatHUMsstVHLnYt3CwiNsfD8dKkBVKlh-C4DWo-1WY5VNTTxPC47Ejy2rGbDLJ9MLdtn6Pr-WyW2mdzd0EKjNFQ", "d": "quAXoet3373KFbGBoz2AgOFA7vcji1j4g5OEcCHmtUhrA2h_q8Vl1wavtqJ-00WdISAbabt7GACDiivzM8I0kd8mBSCrgR26jwmfCgCWydVXLgd44w1MZcUwVbeE8xC38PGJ4XnEYVs7r0OQQInrwtXl_d1BzDYFVVYAQ43-p_1SGASfHv052IJjPKgePFoeheT1xVNS1fCZTSWmFEVPXhbY_LQpnm8DwkR5-hmX-oSjjaJHQoHh4OP8uJ25YAwoMs3-7QOardbEu_DsseeWoQ1MRjnovDWxsxCWa-XTMIPrwF4zP4y-WbtVFILFH7e5fo2WLd5vYSxjOJkiW3TSJQ", "p": "4ZNvp0u6vXQAf7IGESuhu3u4cD6K8iJ6BT-O64yHJzc17e9lt-p89GasTtkgeEH_lr-XxScVBYndi_8vaqsA47bkIoWVvcXq7C4jkv0bPelpaI_KPGfoZC1etR102-dS1ZufxzwSo64drw-HPuwaIkXvmpK4MBI9jEYoOHh9KR8", "q": "3oRU_iCWvKOGHlR9BmcBysVGmkvBwj8XLTJGfxJkm3M9utLSg0uNo7vW0Zm88KdzdeaRBt6ltZAG3hBL0mHNwC0hYRv5fzO7yczWFLPXbUNVqC5OLI-wTL7-ikx040lL9IRRtgub47-9IvxxaGaIRzsFwa-15D7TCE7K8BydH0s", "dp": "ivnkC2VL2tcyS3op5MBF95Vk77qIrl9xX_RloFfHGPEaB8q7l5EfhRAQzs9VAuJejsjhv7SxbeUfmtYQp55NgP44FdDJjc73SqWugyvvcbhxmdslFQxLkBSnydwpGCav0Sz9RqmLLk7iuO1PPQQHoeAGm-wTEILcaqT6uLf7HK8", "dq": "TpZaFi6YTiNKuOeKCHrUzTKDTvc2hU4W92VsNHDgi25V_Od8ZdaHPa6Xngs4CZ56TseRrOVxjQBDDKagwLq-GgNWaJ-irGQvDISFj2Y8zWAcnntMLLzKvTAvYdTC64r1gnRBD5RmCDetqu-RdhfQRaf4zoEqMmRlz-dUER1p-KU", "qi": "ITLsaxLewCPcaJOYKRW9HeApKVIqYlQuYj7wShPq3NiEy_KqgIc-2WXYMfMF6oDoiXYMrP6AVsqWfb4us9StvauAr17yp1kf1ffpazy71gD9VqwZBFQUgBwVw1agEFfv2cFD_z3Os-5to3ZGH0Eq5QQYsoDMN_UkjOx5SvyN2_A", "kty": "RSA", "kid": "rxZogVFbs1tz36D4tmlW0yEHUTfD_mxyF3RSWBe5eHI", "alg": "PS256", "use": "sig", "x5c": [ "MIIC4DCCAcgCCQDuBF1vmG5mlDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwHhcNMTkwNjE4MTIzMTA2WhcNMjAwNjE3MTIzMTA2WjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFGKYDieCWZ63Fx9jMhtlPlHUgkR6bmKqGwvZuVAe9Zz+sHvbVtTk/4AEOjSozksxf070O1PnK3zY0SuZynhKJnTaFouN45iMnnNQS6XMKd9Tm5WpSRbxfaOeuIZybvOmNy0nuxkvqcE5fXIyr9bDCO9WEArQIQqjGJ93zKJpV2nT9Q7heTK430z7Hp3+XxwGXoKsLW/jebr3ryWTMEv8ouEbXeCz2OH6Oup8UIwXDyjYxwhwS5FAcRQdh4KnhHOLGYVAuVR3wPewtrTioYznFdfwtDHGd9fZVxrXPlVqCksj0CTnPf7UgXtjm2hTfkwHHtW2BegWR/q3+q9gs7uehc\u003d" ], "x5t#S256": "E-TFTHXRZVsBSvZ5p5mc7ZZMle2Urpv9yr9PdGcOqXQ" } ] }
hint_type	login_hint
hint_value	panva

2021-07-01 15:28:09		ValidateMTLSCertificatesHeader No certificate authority found for MTLS

2021-07-01 15:28:09	SUCCESS	ValidateMTLSCertificatesHeader MTLS certificates header is valid

2021-07-01 15:28:09		ExtractMTLSCertificatesFromConfiguration No certificate authority found for MTLS

2021-07-01 15:28:09

(2) More

SUCCESS

ExtractMTLSCertificatesFromConfiguration

Mutual TLS authentication credentials loaded

cert

MIIC4DCCAcgCCQDuBF1vmG5mlDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwHhcNMTkwNjE4MTIzMTA2WhcNMjAwNjE3MTIzMTA2WjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFGKYDieCWZ63Fx9jMhtlPlHUgkR6bmKqGwvZuVAe9Zz+sHvbVtTk/4AEOjSozksxf070O1PnK3zY0SuZynhKJnTaFouN45iMnnNQS6XMKd9Tm5WpSRbxfaOeuIZybvOmNy0nuxkvqcE5fXIyr9bDCO9WEArQIQqjGJ93zKJpV2nT9Q7heTK430z7Hp3+XxwGXoKsLW/jebr3ryWTMEv8ouEbXeCz2OH6Oup8UIwXDyjYxwhwS5FAcRQdh4KnhHOLGYVAuVR3wPewtrTioYznFdfwtDHGd9fZVxrXPlVqCksj0CTnPf7UgXtjm2hTfkwHHtW2BegWR/q3+q9gs7uehc=

key

MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAECggEBAKrgF6Hrd9+9yhWxgaM9gIDhQO73I4tY+IOThHAh5rVIawNof6vFZdcGr7aiftNFnSEgG2m7exgAg4or8zPCNJHfJgUgq4Eduo8JnwoAlsnVVy4HeOMNTGXFMFW3hPMQt/DxieF5xGFbO69DkECJ68LV5f3dQcw2BVVWAEON/qf9UhgEnx79OdiCYzyoHjxaHoXk9cVTUtXwmU0lphRFT14W2Py0KZ5vA8JEefoZl/qEo42iR0KB4eDj/LiduWAMKDLN/u0Dmq3WxLvw7LHnlqENTEY56Lw1sbMQlmvl0zCD68BeMz+Mvlm7VRSCxR+3uX6Nli3eb2EsYziZIlt00iUCgYEA4ZNvp0u6vXQAf7IGESuhu3u4cD6K8iJ6BT+O64yHJzc17e9lt+p89GasTtkgeEH/lr+XxScVBYndi/8vaqsA47bkIoWVvcXq7C4jkv0bPelpaI/KPGfoZC1etR102+dS1ZufxzwSo64drw+HPuwaIkXvmpK4MBI9jEYoOHh9KR8CgYEA3oRU/iCWvKOGHlR9BmcBysVGmkvBwj8XLTJGfxJkm3M9utLSg0uNo7vW0Zm88KdzdeaRBt6ltZAG3hBL0mHNwC0hYRv5fzO7yczWFLPXbUNVqC5OLI+wTL7+ikx040lL9IRRtgub47+9IvxxaGaIRzsFwa+15D7TCE7K8BydH0sCgYEAivnkC2VL2tcyS3op5MBF95Vk77qIrl9xX/RloFfHGPEaB8q7l5EfhRAQzs9VAuJejsjhv7SxbeUfmtYQp55NgP44FdDJjc73SqWugyvvcbhxmdslFQxLkBSnydwpGCav0Sz9RqmLLk7iuO1PPQQHoeAGm+wTEILcaqT6uLf7HK8CgYBOlloWLphOI0q454oIetTNMoNO9zaFThb3ZWw0cOCLblX853xl1oc9rpeeCzgJnnpOx5Gs5XGNAEMMpqDAur4aA1Zon6KsZC8MhIWPZjzNYByee0wsvMq9MC9h1MLrivWCdEEPlGYIN62q75F2F9BFp/jOgSoyZGXP51QRHWn4pQKBgCEy7GsS3sAj3GiTmCkVvR3gKSlSKmJULmI+8EoT6tzYhMvyqoCHPtll2DHzBeqA6Il2DKz+gFbKln2+LrPUrb2rgK9e8qdZH9X36Ws8u9YA/VasGQRUFIAcFcNWoBBX79nBQ/89zrPubaN2Rh9BKuUEGLKAzDf1JIzseUr8jdvw

2021-07-01 15:28:09	SUCCESS RFC7517-1.1	ValidateClientJWKsPrivatePart Valid client JWKs: keys are valid JSON, contain the required fields, the private/public exponents match and are correctly encoded using unpadded base64url

2021-07-01 15:28:09

(2) More

SUCCESS

ExtractJWKsFromStaticClientConfiguration

Extracted client JWK

client_jwks

{
  "keys": [
    {
      "e": "AQAB",
      "n": "xBJ1vPOR6ftkO5figrSjzsHzyFTiyrIYMoFiAFwvM-UypwNTfamwdgb6Q6VlCnV62Lgc1nDR_zx8Kyb1-NgBxnlwmSQ0l87kR_d-P34zEB0xSarqD-K84lJUSX0_qcCXLr4MYBiyOcYMzag-4GWaf_S1ZuTnV1NaaEL4lHpfocFeXok9a9XznuSzol5C8Kd5AS5ahq7UTxSCGvttKpL5xYeWXJ0Zjpptr3AJyOzmjXNq0ix1W75BbmPJjBMfK7bYatHUMsstVHLnYt3CwiNsfD8dKkBVKlh-C4DWo-1WY5VNTTxPC47Ejy2rGbDLJ9MLdtn6Pr-WyW2mdzd0EKjNFQ",
      "d": "quAXoet3373KFbGBoz2AgOFA7vcji1j4g5OEcCHmtUhrA2h_q8Vl1wavtqJ-00WdISAbabt7GACDiivzM8I0kd8mBSCrgR26jwmfCgCWydVXLgd44w1MZcUwVbeE8xC38PGJ4XnEYVs7r0OQQInrwtXl_d1BzDYFVVYAQ43-p_1SGASfHv052IJjPKgePFoeheT1xVNS1fCZTSWmFEVPXhbY_LQpnm8DwkR5-hmX-oSjjaJHQoHh4OP8uJ25YAwoMs3-7QOardbEu_DsseeWoQ1MRjnovDWxsxCWa-XTMIPrwF4zP4y-WbtVFILFH7e5fo2WLd5vYSxjOJkiW3TSJQ",
      "p": "4ZNvp0u6vXQAf7IGESuhu3u4cD6K8iJ6BT-O64yHJzc17e9lt-p89GasTtkgeEH_lr-XxScVBYndi_8vaqsA47bkIoWVvcXq7C4jkv0bPelpaI_KPGfoZC1etR102-dS1ZufxzwSo64drw-HPuwaIkXvmpK4MBI9jEYoOHh9KR8",
      "q": "3oRU_iCWvKOGHlR9BmcBysVGmkvBwj8XLTJGfxJkm3M9utLSg0uNo7vW0Zm88KdzdeaRBt6ltZAG3hBL0mHNwC0hYRv5fzO7yczWFLPXbUNVqC5OLI-wTL7-ikx040lL9IRRtgub47-9IvxxaGaIRzsFwa-15D7TCE7K8BydH0s",
      "dp": "ivnkC2VL2tcyS3op5MBF95Vk77qIrl9xX_RloFfHGPEaB8q7l5EfhRAQzs9VAuJejsjhv7SxbeUfmtYQp55NgP44FdDJjc73SqWugyvvcbhxmdslFQxLkBSnydwpGCav0Sz9RqmLLk7iuO1PPQQHoeAGm-wTEILcaqT6uLf7HK8",
      "dq": "TpZaFi6YTiNKuOeKCHrUzTKDTvc2hU4W92VsNHDgi25V_Od8ZdaHPa6Xngs4CZ56TseRrOVxjQBDDKagwLq-GgNWaJ-irGQvDISFj2Y8zWAcnntMLLzKvTAvYdTC64r1gnRBD5RmCDetqu-RdhfQRaf4zoEqMmRlz-dUER1p-KU",
      "qi": "ITLsaxLewCPcaJOYKRW9HeApKVIqYlQuYj7wShPq3NiEy_KqgIc-2WXYMfMF6oDoiXYMrP6AVsqWfb4us9StvauAr17yp1kf1ffpazy71gD9VqwZBFQUgBwVw1agEFfv2cFD_z3Os-5to3ZGH0Eq5QQYsoDMN_UkjOx5SvyN2_A",
      "kty": "RSA",
      "kid": "rxZogVFbs1tz36D4tmlW0yEHUTfD_mxyF3RSWBe5eHI",
      "alg": "PS256",
      "use": "sig",
      "x5c": [
        "MIIC4DCCAcgCCQDuBF1vmG5mlDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwHhcNMTkwNjE4MTIzMTA2WhcNMjAwNjE3MTIzMTA2WjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFGKYDieCWZ63Fx9jMhtlPlHUgkR6bmKqGwvZuVAe9Zz+sHvbVtTk/4AEOjSozksxf070O1PnK3zY0SuZynhKJnTaFouN45iMnnNQS6XMKd9Tm5WpSRbxfaOeuIZybvOmNy0nuxkvqcE5fXIyr9bDCO9WEArQIQqjGJ93zKJpV2nT9Q7heTK430z7Hp3+XxwGXoKsLW/jebr3ryWTMEv8ouEbXeCz2OH6Oup8UIwXDyjYxwhwS5FAcRQdh4KnhHOLGYVAuVR3wPewtrTioYznFdfwtDHGd9fZVxrXPlVqCksj0CTnPf7UgXtjm2hTfkwHHtW2BegWR/q3+q9gs7uehc\u003d"
      ],
      "x5t#S256": "E-TFTHXRZVsBSvZ5p5mc7ZZMle2Urpv9yr9PdGcOqXQ"
    }
  ]
}

public_client_jwks

{
  "keys": [
    {
      "kty": "RSA",
      "x5t#S256": "E-TFTHXRZVsBSvZ5p5mc7ZZMle2Urpv9yr9PdGcOqXQ",
      "e": "AQAB",
      "use": "sig",
      "kid": "rxZogVFbs1tz36D4tmlW0yEHUTfD_mxyF3RSWBe5eHI",
      "x5c": [
        "MIIC4DCCAcgCCQDuBF1vmG5mlDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwHhcNMTkwNjE4MTIzMTA2WhcNMjAwNjE3MTIzMTA2WjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFGKYDieCWZ63Fx9jMhtlPlHUgkR6bmKqGwvZuVAe9Zz+sHvbVtTk/4AEOjSozksxf070O1PnK3zY0SuZynhKJnTaFouN45iMnnNQS6XMKd9Tm5WpSRbxfaOeuIZybvOmNy0nuxkvqcE5fXIyr9bDCO9WEArQIQqjGJ93zKJpV2nT9Q7heTK430z7Hp3+XxwGXoKsLW/jebr3ryWTMEv8ouEbXeCz2OH6Oup8UIwXDyjYxwhwS5FAcRQdh4KnhHOLGYVAuVR3wPewtrTioYznFdfwtDHGd9fZVxrXPlVqCksj0CTnPf7UgXtjm2hTfkwHHtW2BegWR/q3+q9gs7uehc\u003d"
      ],
      "alg": "PS256",
      "n": "xBJ1vPOR6ftkO5figrSjzsHzyFTiyrIYMoFiAFwvM-UypwNTfamwdgb6Q6VlCnV62Lgc1nDR_zx8Kyb1-NgBxnlwmSQ0l87kR_d-P34zEB0xSarqD-K84lJUSX0_qcCXLr4MYBiyOcYMzag-4GWaf_S1ZuTnV1NaaEL4lHpfocFeXok9a9XznuSzol5C8Kd5AS5ahq7UTxSCGvttKpL5xYeWXJ0Zjpptr3AJyOzmjXNq0ix1W75BbmPJjBMfK7bYatHUMsstVHLnYt3CwiNsfD8dKkBVKlh-C4DWo-1WY5VNTTxPC47Ejy2rGbDLJ9MLdtn6Pr-WyW2mdzd0EKjNFQ"
    }
  ]
}

2021-07-01 15:28:09	SUCCESS OIDCC-10.1	CheckForKeyIdInClientJWKs All keys contain kids

2021-07-01 15:28:09

(1) More

SUCCESS

RFC7517-4.5

CheckDistinctKeyIdValueInClientJWKs

Distinct 'kid' value in all keys of client_jwks

see	https://bitbucket.org/openid/connect/issues/1127

2021-07-01 15:28:09

(1) More

SUCCESS

FAPI1-ADV-8.6

FAPICheckKeyAlgInClientJWKs

Keys in client JWKS all have permitted 'alg'

permitted

[
  "ES256",
  "PS256"
]

2021-07-01 15:28:09

(1) More

SUCCESS

FAPI1-BASE-5.2.2-6 FAPI1-BASE-5.2.2-5

FAPIEnsureMinimumClientKeyLength

Validated minimum key lengths for client_jwks

client_jwks

{
  "keys": [
    {
      "e": "AQAB",
      "n": "xBJ1vPOR6ftkO5figrSjzsHzyFTiyrIYMoFiAFwvM-UypwNTfamwdgb6Q6VlCnV62Lgc1nDR_zx8Kyb1-NgBxnlwmSQ0l87kR_d-P34zEB0xSarqD-K84lJUSX0_qcCXLr4MYBiyOcYMzag-4GWaf_S1ZuTnV1NaaEL4lHpfocFeXok9a9XznuSzol5C8Kd5AS5ahq7UTxSCGvttKpL5xYeWXJ0Zjpptr3AJyOzmjXNq0ix1W75BbmPJjBMfK7bYatHUMsstVHLnYt3CwiNsfD8dKkBVKlh-C4DWo-1WY5VNTTxPC47Ejy2rGbDLJ9MLdtn6Pr-WyW2mdzd0EKjNFQ",
      "d": "quAXoet3373KFbGBoz2AgOFA7vcji1j4g5OEcCHmtUhrA2h_q8Vl1wavtqJ-00WdISAbabt7GACDiivzM8I0kd8mBSCrgR26jwmfCgCWydVXLgd44w1MZcUwVbeE8xC38PGJ4XnEYVs7r0OQQInrwtXl_d1BzDYFVVYAQ43-p_1SGASfHv052IJjPKgePFoeheT1xVNS1fCZTSWmFEVPXhbY_LQpnm8DwkR5-hmX-oSjjaJHQoHh4OP8uJ25YAwoMs3-7QOardbEu_DsseeWoQ1MRjnovDWxsxCWa-XTMIPrwF4zP4y-WbtVFILFH7e5fo2WLd5vYSxjOJkiW3TSJQ",
      "p": "4ZNvp0u6vXQAf7IGESuhu3u4cD6K8iJ6BT-O64yHJzc17e9lt-p89GasTtkgeEH_lr-XxScVBYndi_8vaqsA47bkIoWVvcXq7C4jkv0bPelpaI_KPGfoZC1etR102-dS1ZufxzwSo64drw-HPuwaIkXvmpK4MBI9jEYoOHh9KR8",
      "q": "3oRU_iCWvKOGHlR9BmcBysVGmkvBwj8XLTJGfxJkm3M9utLSg0uNo7vW0Zm88KdzdeaRBt6ltZAG3hBL0mHNwC0hYRv5fzO7yczWFLPXbUNVqC5OLI-wTL7-ikx040lL9IRRtgub47-9IvxxaGaIRzsFwa-15D7TCE7K8BydH0s",
      "dp": "ivnkC2VL2tcyS3op5MBF95Vk77qIrl9xX_RloFfHGPEaB8q7l5EfhRAQzs9VAuJejsjhv7SxbeUfmtYQp55NgP44FdDJjc73SqWugyvvcbhxmdslFQxLkBSnydwpGCav0Sz9RqmLLk7iuO1PPQQHoeAGm-wTEILcaqT6uLf7HK8",
      "dq": "TpZaFi6YTiNKuOeKCHrUzTKDTvc2hU4W92VsNHDgi25V_Od8ZdaHPa6Xngs4CZ56TseRrOVxjQBDDKagwLq-GgNWaJ-irGQvDISFj2Y8zWAcnntMLLzKvTAvYdTC64r1gnRBD5RmCDetqu-RdhfQRaf4zoEqMmRlz-dUER1p-KU",
      "qi": "ITLsaxLewCPcaJOYKRW9HeApKVIqYlQuYj7wShPq3NiEy_KqgIc-2WXYMfMF6oDoiXYMrP6AVsqWfb4us9StvauAr17yp1kf1ffpazy71gD9VqwZBFQUgBwVw1agEFfv2cFD_z3Os-5to3ZGH0Eq5QQYsoDMN_UkjOx5SvyN2_A",
      "kty": "RSA",
      "kid": "rxZogVFbs1tz36D4tmlW0yEHUTfD_mxyF3RSWBe5eHI",
      "alg": "PS256",
      "use": "sig",
      "x5c": [
        "MIIC4DCCAcgCCQDuBF1vmG5mlDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwHhcNMTkwNjE4MTIzMTA2WhcNMjAwNjE3MTIzMTA2WjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFGKYDieCWZ63Fx9jMhtlPlHUgkR6bmKqGwvZuVAe9Zz+sHvbVtTk/4AEOjSozksxf070O1PnK3zY0SuZynhKJnTaFouN45iMnnNQS6XMKd9Tm5WpSRbxfaOeuIZybvOmNy0nuxkvqcE5fXIyr9bDCO9WEArQIQqjGJ93zKJpV2nT9Q7heTK430z7Hp3+XxwGXoKsLW/jebr3ryWTMEv8ouEbXeCz2OH6Oup8UIwXDyjYxwhwS5FAcRQdh4KnhHOLGYVAuVR3wPewtrTioYznFdfwtDHGd9fZVxrXPlVqCksj0CTnPf7UgXtjm2hTfkwHHtW2BegWR/q3+q9gs7uehc\u003d"
      ],
      "x5t#S256": "E-TFTHXRZVsBSvZ5p5mc7ZZMle2Urpv9yr9PdGcOqXQ"
    }
  ]
}

2021-07-01 15:28:09	SUCCESS	ValidateMTLSCertificatesAsX509 Mutual TLS authentication cert validated as X.509

Verify configuration of second client

2021-07-01 15:28:09

(5) More

SUCCESS

GetStaticClient2Configuration

Found a static second client object

client_id	mtls-two
client_name	mtls-two
scope	openid offline_access
jwks	{ "keys": [ { "e": "AQAB", "n": "4alQGjLL5whE8w7SsHysWQtY8CDoSMlKfMaftqDfqScLaj9FKZC5U1ezA_eB2Ui9593_YbBumqaUUBhgCdk4TsNTfc5QK-0pPWB-hrbt22Eg70usGio1aMRq65i38rqBG79zw6jFrjoxNzE_xtZ8FAYCBCmAK_IYs2PHVBNGdqlryhWSY-nrYwlxKaY17sJUrrB1sP7Y_3jzDMTACTDz4cyXoegC-4lCgYrCcrD7mlq0vZ7XT8b_T0uNLL-nGU-MKMZhOraUwpAMWm16gNuUoCTsijo574PgTzZa7nC6h8NxK1q8WEy_fXB6oXsTuiuBWrKVt_tZLlnd32OApvs5Ew", "d": "SlRt2SNQPJphs7n3NkDquC3frsD4IjmDepQmOY7F_T6qKOYMTwOnt8cUZUMal0q5mu1p2HC4DeK-yZ8tyzCstmzqTG8vwzhMNDZblt4cfP2CTrAbUUcD7q18FnxoYuCB9HTcmd82tgve-DIVstYlaqcL9PkCifcloblFB_GNbToEdiHqRNbHvVZLMYGYsShkiyFVL61h5zkFgQCBv-kR5u3AWGGGtlhZ3dvU7-i0P7n4dKseQyyd9v_QcW4iW8b3f6izn4plQNcPbb4o0iAdhpnjYxCOwxc8TGZvHul_RYnlFGuiKUXSV_r_t_dEppsKM4moJ8n6qzsoZf6czR5NwQ", "p": "_supybPbDRLiAWtiYxGSGIVV41UTvV5LrKjd2qCslOPF_iYOP1wyTFOjUWjBHWqaaPCYMpK4NIdnDUuCQ5K8Nz8FaIWkdUksDXJYO3FZR-dBzulkyKwNZQE-1VwT7MYlIih695zaYdtnIRw0cN6oYW5bheDYdE13SzcLK3XGMqE", "q": "4rpkthJwjk-brxKVuDIxUVXiwbArdbQLn1UXBdl54Mn4C5ntMy50BofGaqxx6WZoGUATNwD5w7Sf1KsxCMIObLr6xNVNpUnI766VaV69WYiFdB3N8BBi3L4Jmb1hLXIyX2WITTHY2w5UKOYwD6pKCa5FldqArm5slJCpmtffQzM", "dp": "ApnXoNx6JvcDYZpUBcjfIeryhoCO1AcLZLbQlPPA70An_EEtMg5h4Q-VgjY8im1VKC8Ujqeaw8aCEcush74Ot82n43pBxIS7s2NwbSLqE2bT8CXHxpijBl3t40WuWmNna6LYJoDuZcNUmSztiB1twJjczFAQRZeo2Ra1wXrRTCE", "dq": "jpFaZsrtj-8rHEl5b9vP-y8gaV7X1Smj7UraMUlxRBJ8MP9Xkklxl_GkqMtKzdMhPk92Ra4NYCyiHF6RdMphu6lPqpneO0NMYLrNJPb35ebc1Akxx_Tl1ZyB-PSGuMcIOchkjvX7QLOf5B_qtM8Fw1ScWQCOziCNklXs8Hsx3tU", "qi": "Z_CBJI5NGWkGZjkLM4fqq8U2hFM9Y5IHsn9Y8vvst3-mCqcFhTS7TcYUY00qdiFXAJjiwhfGFOoc0q-AWluiUxB-b6FWRu73XhqkKxgBehE9i3QCrcitMufSkXKydLonfh7_PeUpB63LmMjtyLdMlGAIorVbtD1xAn2WaYuEb5Q", "kty": "RSA", "kid": "LJuZnTrnhtSbpcjnu4pq3Xvrmzy6sI_fUOd7L7Bh9to", "alg": "PS256", "use": "sig", "x5c": [ "MIIC4DCCAcgCCQDO8JBSH914NDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wHhcNMTkwNjE4MTIzMjAxWhcNMjAwNjE3MTIzMjAxWjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhqVAaMsvnCETzDtKwfKxZC1jwIOhIyUp8xp+2oN+pJwtqP0UpkLlTV7MD94HZSL3n3f9hsG6appRQGGAJ2ThOw1N9zlAr7Sk9YH6Gtu3bYSDvS6waKjVoxGrrmLfyuoEbv3PDqMWuOjE3MT/G1nwUBgIEKYAr8hizY8dUE0Z2qWvKFZJj6etjCXEppjXuwlSusHWw/tj/ePMMxMAJMPPhzJeh6AL7iUKBisJysPuaWrS9ntdPxv9PS40sv6cZT4woxmE6tpTCkAxabXqA25SgJOyKOjnvg+BPNlrucLqHw3ErWrxYTL99cHqhexO6K4FaspW3+1kuWd3fY4Cm+zkTAgMBAAEwDQYJKoZIhvcNAQELBQADggEBALsB6MGWke5vS1TB3Z+NJkC29bEIb3XGC9WaxRovH0jqaaua2AfAF7VZzUyWS/+r6hvWOtqUVy7YF1ThnEJXuXJG9ra2B2+F5RYNCtrVj6Bi+zDTSJ4IvQfrF0XBKwwOdRu7VJpAxvweA/3woKl6Cjfy20ZupPH9mxr1R78BMKgEtdFsiLwbB7MOdDbTLsrUcEcupXv+gZek22upQKrAk/XFP067KIqKmCEhDidxhP251SloUaruv9cHEx0aDKol9eR465FAiBLvg2N7qJHCKlWdn99SgN4Y3kINsuFR7Tj4QIJZNubOjV0YeOgnAWzRJlZD89KZAQgjj4Z215QeLxA\u003d" ], "x5t#S256": "B_QzvtQ9biL043xj_ADE7e9MUdWwbdAr3W3W7JHbK9c" } ] }
acr_value	urn:mace:incommon:iap:silver

2021-07-01 15:28:09		ValidateMTLSCertificates2Header No certificate authority found for MTLS

2021-07-01 15:28:09	SUCCESS	ValidateMTLSCertificates2Header MTLS certificates header is valid

2021-07-01 15:28:09		ExtractMTLSCertificates2FromConfiguration No certificate authority found for MTLS

2021-07-01 15:28:09

(2) More

SUCCESS

ExtractMTLSCertificates2FromConfiguration

Mutual TLS authentication credentials loaded

cert

MIIC4DCCAcgCCQDO8JBSH914NDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wHhcNMTkwNjE4MTIzMjAxWhcNMjAwNjE3MTIzMjAxWjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhqVAaMsvnCETzDtKwfKxZC1jwIOhIyUp8xp+2oN+pJwtqP0UpkLlTV7MD94HZSL3n3f9hsG6appRQGGAJ2ThOw1N9zlAr7Sk9YH6Gtu3bYSDvS6waKjVoxGrrmLfyuoEbv3PDqMWuOjE3MT/G1nwUBgIEKYAr8hizY8dUE0Z2qWvKFZJj6etjCXEppjXuwlSusHWw/tj/ePMMxMAJMPPhzJeh6AL7iUKBisJysPuaWrS9ntdPxv9PS40sv6cZT4woxmE6tpTCkAxabXqA25SgJOyKOjnvg+BPNlrucLqHw3ErWrxYTL99cHqhexO6K4FaspW3+1kuWd3fY4Cm+zkTAgMBAAEwDQYJKoZIhvcNAQELBQADggEBALsB6MGWke5vS1TB3Z+NJkC29bEIb3XGC9WaxRovH0jqaaua2AfAF7VZzUyWS/+r6hvWOtqUVy7YF1ThnEJXuXJG9ra2B2+F5RYNCtrVj6Bi+zDTSJ4IvQfrF0XBKwwOdRu7VJpAxvweA/3woKl6Cjfy20ZupPH9mxr1R78BMKgEtdFsiLwbB7MOdDbTLsrUcEcupXv+gZek22upQKrAk/XFP067KIqKmCEhDidxhP251SloUaruv9cHEx0aDKol9eR465FAiBLvg2N7qJHCKlWdn99SgN4Y3kINsuFR7Tj4QIJZNubOjV0YeOgnAWzRJlZD89KZAQgjj4Z215QeLxA=

key

MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDhqVAaMsvnCETzDtKwfKxZC1jwIOhIyUp8xp+2oN+pJwtqP0UpkLlTV7MD94HZSL3n3f9hsG6appRQGGAJ2ThOw1N9zlAr7Sk9YH6Gtu3bYSDvS6waKjVoxGrrmLfyuoEbv3PDqMWuOjE3MT/G1nwUBgIEKYAr8hizY8dUE0Z2qWvKFZJj6etjCXEppjXuwlSusHWw/tj/ePMMxMAJMPPhzJeh6AL7iUKBisJysPuaWrS9ntdPxv9PS40sv6cZT4woxmE6tpTCkAxabXqA25SgJOyKOjnvg+BPNlrucLqHw3ErWrxYTL99cHqhexO6K4FaspW3+1kuWd3fY4Cm+zkTAgMBAAECggEASlRt2SNQPJphs7n3NkDquC3frsD4IjmDepQmOY7F/T6qKOYMTwOnt8cUZUMal0q5mu1p2HC4DeK+yZ8tyzCstmzqTG8vwzhMNDZblt4cfP2CTrAbUUcD7q18FnxoYuCB9HTcmd82tgve+DIVstYlaqcL9PkCifcloblFB/GNbToEdiHqRNbHvVZLMYGYsShkiyFVL61h5zkFgQCBv+kR5u3AWGGGtlhZ3dvU7+i0P7n4dKseQyyd9v/QcW4iW8b3f6izn4plQNcPbb4o0iAdhpnjYxCOwxc8TGZvHul/RYnlFGuiKUXSV/r/t/dEppsKM4moJ8n6qzsoZf6czR5NwQKBgQD+y6nJs9sNEuIBa2JjEZIYhVXjVRO9XkusqN3aoKyU48X+Jg4/XDJMU6NRaMEdappo8Jgykrg0h2cNS4JDkrw3PwVohaR1SSwNclg7cVlH50HO6WTIrA1lAT7VXBPsxiUiKHr3nNph22chHDRw3qhhbluF4Nh0TXdLNwsrdcYyoQKBgQDiumS2EnCOT5uvEpW4MjFRVeLBsCt1tAufVRcF2XngyfgLme0zLnQGh8ZqrHHpZmgZQBM3APnDtJ/UqzEIwg5suvrE1U2lScjvrpVpXr1ZiIV0Hc3wEGLcvgmZvWEtcjJfZYhNMdjbDlQo5jAPqkoJrkWV2oCubmyUkKma199DMwKBgAKZ16Dceib3A2GaVAXI3yHq8oaAjtQHC2S20JTzwO9AJ/xBLTIOYeEPlYI2PIptVSgvFI6nmsPGghHLrIe+DrfNp+N6QcSEu7NjcG0i6hNm0/Alx8aYowZd7eNFrlpjZ2ui2CaA7mXDVJks7YgdbcCY3MxQEEWXqNkWtcF60UwhAoGBAI6RWmbK7Y/vKxxJeW/bz/svIGle19Upo+1K2jFJcUQSfDD/V5JJcZfxpKjLSs3TIT5PdkWuDWAsohxekXTKYbupT6qZ3jtDTGC6zST29+Xm3NQJMcf05dWcgfj0hrjHCDnIZI71+0Czn+Qf6rTPBcNUnFkAjs4gjZJV7PB7Md7VAoGAZ/CBJI5NGWkGZjkLM4fqq8U2hFM9Y5IHsn9Y8vvst3+mCqcFhTS7TcYUY00qdiFXAJjiwhfGFOoc0q+AWluiUxB+b6FWRu73XhqkKxgBehE9i3QCrcitMufSkXKydLonfh7/PeUpB63LmMjtyLdMlGAIorVbtD1xAn2WaYuEb5Q=

2021-07-01 15:28:09	SUCCESS RFC7517-1.1	ValidateClientJWKsPrivatePart Valid client JWKs: keys are valid JSON, contain the required fields, the private/public exponents match and are correctly encoded using unpadded base64url

2021-07-01 15:28:09

(2) More

SUCCESS

ExtractJWKsFromStaticClientConfiguration

Extracted client JWK

client_jwks

{
  "keys": [
    {
      "e": "AQAB",
      "n": "4alQGjLL5whE8w7SsHysWQtY8CDoSMlKfMaftqDfqScLaj9FKZC5U1ezA_eB2Ui9593_YbBumqaUUBhgCdk4TsNTfc5QK-0pPWB-hrbt22Eg70usGio1aMRq65i38rqBG79zw6jFrjoxNzE_xtZ8FAYCBCmAK_IYs2PHVBNGdqlryhWSY-nrYwlxKaY17sJUrrB1sP7Y_3jzDMTACTDz4cyXoegC-4lCgYrCcrD7mlq0vZ7XT8b_T0uNLL-nGU-MKMZhOraUwpAMWm16gNuUoCTsijo574PgTzZa7nC6h8NxK1q8WEy_fXB6oXsTuiuBWrKVt_tZLlnd32OApvs5Ew",
      "d": "SlRt2SNQPJphs7n3NkDquC3frsD4IjmDepQmOY7F_T6qKOYMTwOnt8cUZUMal0q5mu1p2HC4DeK-yZ8tyzCstmzqTG8vwzhMNDZblt4cfP2CTrAbUUcD7q18FnxoYuCB9HTcmd82tgve-DIVstYlaqcL9PkCifcloblFB_GNbToEdiHqRNbHvVZLMYGYsShkiyFVL61h5zkFgQCBv-kR5u3AWGGGtlhZ3dvU7-i0P7n4dKseQyyd9v_QcW4iW8b3f6izn4plQNcPbb4o0iAdhpnjYxCOwxc8TGZvHul_RYnlFGuiKUXSV_r_t_dEppsKM4moJ8n6qzsoZf6czR5NwQ",
      "p": "_supybPbDRLiAWtiYxGSGIVV41UTvV5LrKjd2qCslOPF_iYOP1wyTFOjUWjBHWqaaPCYMpK4NIdnDUuCQ5K8Nz8FaIWkdUksDXJYO3FZR-dBzulkyKwNZQE-1VwT7MYlIih695zaYdtnIRw0cN6oYW5bheDYdE13SzcLK3XGMqE",
      "q": "4rpkthJwjk-brxKVuDIxUVXiwbArdbQLn1UXBdl54Mn4C5ntMy50BofGaqxx6WZoGUATNwD5w7Sf1KsxCMIObLr6xNVNpUnI766VaV69WYiFdB3N8BBi3L4Jmb1hLXIyX2WITTHY2w5UKOYwD6pKCa5FldqArm5slJCpmtffQzM",
      "dp": "ApnXoNx6JvcDYZpUBcjfIeryhoCO1AcLZLbQlPPA70An_EEtMg5h4Q-VgjY8im1VKC8Ujqeaw8aCEcush74Ot82n43pBxIS7s2NwbSLqE2bT8CXHxpijBl3t40WuWmNna6LYJoDuZcNUmSztiB1twJjczFAQRZeo2Ra1wXrRTCE",
      "dq": "jpFaZsrtj-8rHEl5b9vP-y8gaV7X1Smj7UraMUlxRBJ8MP9Xkklxl_GkqMtKzdMhPk92Ra4NYCyiHF6RdMphu6lPqpneO0NMYLrNJPb35ebc1Akxx_Tl1ZyB-PSGuMcIOchkjvX7QLOf5B_qtM8Fw1ScWQCOziCNklXs8Hsx3tU",
      "qi": "Z_CBJI5NGWkGZjkLM4fqq8U2hFM9Y5IHsn9Y8vvst3-mCqcFhTS7TcYUY00qdiFXAJjiwhfGFOoc0q-AWluiUxB-b6FWRu73XhqkKxgBehE9i3QCrcitMufSkXKydLonfh7_PeUpB63LmMjtyLdMlGAIorVbtD1xAn2WaYuEb5Q",
      "kty": "RSA",
      "kid": "LJuZnTrnhtSbpcjnu4pq3Xvrmzy6sI_fUOd7L7Bh9to",
      "alg": "PS256",
      "use": "sig",
      "x5c": [
        "MIIC4DCCAcgCCQDO8JBSH914NDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wHhcNMTkwNjE4MTIzMjAxWhcNMjAwNjE3MTIzMjAxWjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhqVAaMsvnCETzDtKwfKxZC1jwIOhIyUp8xp+2oN+pJwtqP0UpkLlTV7MD94HZSL3n3f9hsG6appRQGGAJ2ThOw1N9zlAr7Sk9YH6Gtu3bYSDvS6waKjVoxGrrmLfyuoEbv3PDqMWuOjE3MT/G1nwUBgIEKYAr8hizY8dUE0Z2qWvKFZJj6etjCXEppjXuwlSusHWw/tj/ePMMxMAJMPPhzJeh6AL7iUKBisJysPuaWrS9ntdPxv9PS40sv6cZT4woxmE6tpTCkAxabXqA25SgJOyKOjnvg+BPNlrucLqHw3ErWrxYTL99cHqhexO6K4FaspW3+1kuWd3fY4Cm+zkTAgMBAAEwDQYJKoZIhvcNAQELBQADggEBALsB6MGWke5vS1TB3Z+NJkC29bEIb3XGC9WaxRovH0jqaaua2AfAF7VZzUyWS/+r6hvWOtqUVy7YF1ThnEJXuXJG9ra2B2+F5RYNCtrVj6Bi+zDTSJ4IvQfrF0XBKwwOdRu7VJpAxvweA/3woKl6Cjfy20ZupPH9mxr1R78BMKgEtdFsiLwbB7MOdDbTLsrUcEcupXv+gZek22upQKrAk/XFP067KIqKmCEhDidxhP251SloUaruv9cHEx0aDKol9eR465FAiBLvg2N7qJHCKlWdn99SgN4Y3kINsuFR7Tj4QIJZNubOjV0YeOgnAWzRJlZD89KZAQgjj4Z215QeLxA\u003d"
      ],
      "x5t#S256": "B_QzvtQ9biL043xj_ADE7e9MUdWwbdAr3W3W7JHbK9c"
    }
  ]
}

public_client_jwks

{
  "keys": [
    {
      "kty": "RSA",
      "x5t#S256": "B_QzvtQ9biL043xj_ADE7e9MUdWwbdAr3W3W7JHbK9c",
      "e": "AQAB",
      "use": "sig",
      "kid": "LJuZnTrnhtSbpcjnu4pq3Xvrmzy6sI_fUOd7L7Bh9to",
      "x5c": [
        "MIIC4DCCAcgCCQDO8JBSH914NDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wHhcNMTkwNjE4MTIzMjAxWhcNMjAwNjE3MTIzMjAxWjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhqVAaMsvnCETzDtKwfKxZC1jwIOhIyUp8xp+2oN+pJwtqP0UpkLlTV7MD94HZSL3n3f9hsG6appRQGGAJ2ThOw1N9zlAr7Sk9YH6Gtu3bYSDvS6waKjVoxGrrmLfyuoEbv3PDqMWuOjE3MT/G1nwUBgIEKYAr8hizY8dUE0Z2qWvKFZJj6etjCXEppjXuwlSusHWw/tj/ePMMxMAJMPPhzJeh6AL7iUKBisJysPuaWrS9ntdPxv9PS40sv6cZT4woxmE6tpTCkAxabXqA25SgJOyKOjnvg+BPNlrucLqHw3ErWrxYTL99cHqhexO6K4FaspW3+1kuWd3fY4Cm+zkTAgMBAAEwDQYJKoZIhvcNAQELBQADggEBALsB6MGWke5vS1TB3Z+NJkC29bEIb3XGC9WaxRovH0jqaaua2AfAF7VZzUyWS/+r6hvWOtqUVy7YF1ThnEJXuXJG9ra2B2+F5RYNCtrVj6Bi+zDTSJ4IvQfrF0XBKwwOdRu7VJpAxvweA/3woKl6Cjfy20ZupPH9mxr1R78BMKgEtdFsiLwbB7MOdDbTLsrUcEcupXv+gZek22upQKrAk/XFP067KIqKmCEhDidxhP251SloUaruv9cHEx0aDKol9eR465FAiBLvg2N7qJHCKlWdn99SgN4Y3kINsuFR7Tj4QIJZNubOjV0YeOgnAWzRJlZD89KZAQgjj4Z215QeLxA\u003d"
      ],
      "alg": "PS256",
      "n": "4alQGjLL5whE8w7SsHysWQtY8CDoSMlKfMaftqDfqScLaj9FKZC5U1ezA_eB2Ui9593_YbBumqaUUBhgCdk4TsNTfc5QK-0pPWB-hrbt22Eg70usGio1aMRq65i38rqBG79zw6jFrjoxNzE_xtZ8FAYCBCmAK_IYs2PHVBNGdqlryhWSY-nrYwlxKaY17sJUrrB1sP7Y_3jzDMTACTDz4cyXoegC-4lCgYrCcrD7mlq0vZ7XT8b_T0uNLL-nGU-MKMZhOraUwpAMWm16gNuUoCTsijo574PgTzZa7nC6h8NxK1q8WEy_fXB6oXsTuiuBWrKVt_tZLlnd32OApvs5Ew"
    }
  ]
}

2021-07-01 15:28:09	SUCCESS OIDCC-10.1	CheckForKeyIdInClientJWKs All keys contain kids

2021-07-01 15:28:09

(1) More

SUCCESS

RFC7517-4.5

CheckDistinctKeyIdValueInClientJWKs

Distinct 'kid' value in all keys of client_jwks

see	https://bitbucket.org/openid/connect/issues/1127

2021-07-01 15:28:09

(1) More

SUCCESS

FAPI1-ADV-8.6

FAPICheckKeyAlgInClientJWKs

Keys in client JWKS all have permitted 'alg'

permitted

[
  "ES256",
  "PS256"
]

2021-07-01 15:28:09

(1) More

SUCCESS

FAPI1-BASE-5.2.2-6 FAPI1-BASE-5.2.2-5

FAPIEnsureMinimumClientKeyLength

Validated minimum key lengths for client_jwks

client_jwks

{
  "keys": [
    {
      "e": "AQAB",
      "n": "4alQGjLL5whE8w7SsHysWQtY8CDoSMlKfMaftqDfqScLaj9FKZC5U1ezA_eB2Ui9593_YbBumqaUUBhgCdk4TsNTfc5QK-0pPWB-hrbt22Eg70usGio1aMRq65i38rqBG79zw6jFrjoxNzE_xtZ8FAYCBCmAK_IYs2PHVBNGdqlryhWSY-nrYwlxKaY17sJUrrB1sP7Y_3jzDMTACTDz4cyXoegC-4lCgYrCcrD7mlq0vZ7XT8b_T0uNLL-nGU-MKMZhOraUwpAMWm16gNuUoCTsijo574PgTzZa7nC6h8NxK1q8WEy_fXB6oXsTuiuBWrKVt_tZLlnd32OApvs5Ew",
      "d": "SlRt2SNQPJphs7n3NkDquC3frsD4IjmDepQmOY7F_T6qKOYMTwOnt8cUZUMal0q5mu1p2HC4DeK-yZ8tyzCstmzqTG8vwzhMNDZblt4cfP2CTrAbUUcD7q18FnxoYuCB9HTcmd82tgve-DIVstYlaqcL9PkCifcloblFB_GNbToEdiHqRNbHvVZLMYGYsShkiyFVL61h5zkFgQCBv-kR5u3AWGGGtlhZ3dvU7-i0P7n4dKseQyyd9v_QcW4iW8b3f6izn4plQNcPbb4o0iAdhpnjYxCOwxc8TGZvHul_RYnlFGuiKUXSV_r_t_dEppsKM4moJ8n6qzsoZf6czR5NwQ",
      "p": "_supybPbDRLiAWtiYxGSGIVV41UTvV5LrKjd2qCslOPF_iYOP1wyTFOjUWjBHWqaaPCYMpK4NIdnDUuCQ5K8Nz8FaIWkdUksDXJYO3FZR-dBzulkyKwNZQE-1VwT7MYlIih695zaYdtnIRw0cN6oYW5bheDYdE13SzcLK3XGMqE",
      "q": "4rpkthJwjk-brxKVuDIxUVXiwbArdbQLn1UXBdl54Mn4C5ntMy50BofGaqxx6WZoGUATNwD5w7Sf1KsxCMIObLr6xNVNpUnI766VaV69WYiFdB3N8BBi3L4Jmb1hLXIyX2WITTHY2w5UKOYwD6pKCa5FldqArm5slJCpmtffQzM",
      "dp": "ApnXoNx6JvcDYZpUBcjfIeryhoCO1AcLZLbQlPPA70An_EEtMg5h4Q-VgjY8im1VKC8Ujqeaw8aCEcush74Ot82n43pBxIS7s2NwbSLqE2bT8CXHxpijBl3t40WuWmNna6LYJoDuZcNUmSztiB1twJjczFAQRZeo2Ra1wXrRTCE",
      "dq": "jpFaZsrtj-8rHEl5b9vP-y8gaV7X1Smj7UraMUlxRBJ8MP9Xkklxl_GkqMtKzdMhPk92Ra4NYCyiHF6RdMphu6lPqpneO0NMYLrNJPb35ebc1Akxx_Tl1ZyB-PSGuMcIOchkjvX7QLOf5B_qtM8Fw1ScWQCOziCNklXs8Hsx3tU",
      "qi": "Z_CBJI5NGWkGZjkLM4fqq8U2hFM9Y5IHsn9Y8vvst3-mCqcFhTS7TcYUY00qdiFXAJjiwhfGFOoc0q-AWluiUxB-b6FWRu73XhqkKxgBehE9i3QCrcitMufSkXKydLonfh7_PeUpB63LmMjtyLdMlGAIorVbtD1xAn2WaYuEb5Q",
      "kty": "RSA",
      "kid": "LJuZnTrnhtSbpcjnu4pq3Xvrmzy6sI_fUOd7L7Bh9to",
      "alg": "PS256",
      "use": "sig",
      "x5c": [
        "MIIC4DCCAcgCCQDO8JBSH914NDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wHhcNMTkwNjE4MTIzMjAxWhcNMjAwNjE3MTIzMjAxWjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHN0d28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhqVAaMsvnCETzDtKwfKxZC1jwIOhIyUp8xp+2oN+pJwtqP0UpkLlTV7MD94HZSL3n3f9hsG6appRQGGAJ2ThOw1N9zlAr7Sk9YH6Gtu3bYSDvS6waKjVoxGrrmLfyuoEbv3PDqMWuOjE3MT/G1nwUBgIEKYAr8hizY8dUE0Z2qWvKFZJj6etjCXEppjXuwlSusHWw/tj/ePMMxMAJMPPhzJeh6AL7iUKBisJysPuaWrS9ntdPxv9PS40sv6cZT4woxmE6tpTCkAxabXqA25SgJOyKOjnvg+BPNlrucLqHw3ErWrxYTL99cHqhexO6K4FaspW3+1kuWd3fY4Cm+zkTAgMBAAEwDQYJKoZIhvcNAQELBQADggEBALsB6MGWke5vS1TB3Z+NJkC29bEIb3XGC9WaxRovH0jqaaua2AfAF7VZzUyWS/+r6hvWOtqUVy7YF1ThnEJXuXJG9ra2B2+F5RYNCtrVj6Bi+zDTSJ4IvQfrF0XBKwwOdRu7VJpAxvweA/3woKl6Cjfy20ZupPH9mxr1R78BMKgEtdFsiLwbB7MOdDbTLsrUcEcupXv+gZek22upQKrAk/XFP067KIqKmCEhDidxhP251SloUaruv9cHEx0aDKol9eR465FAiBLvg2N7qJHCKlWdn99SgN4Y3kINsuFR7Tj4QIJZNubOjV0YeOgnAWzRJlZD89KZAQgjj4Z215QeLxA\u003d"
      ],
      "x5t#S256": "B_QzvtQ9biL043xj_ADE7e9MUdWwbdAr3W3W7JHbK9c"
    }
  ]
}

2021-07-01 15:28:09	SUCCESS	ValidateMTLSCertificatesAsX509 Mutual TLS authentication cert validated as X.509

2021-07-01 15:28:09

(2) More

SUCCESS

GetResourceEndpointConfiguration

Found a resource endpoint object

resourceUrl	https://mtls.fapi.panva.cz/accounts
institution_id	xxxxx

2021-07-01 15:28:09

(1) More

SUCCESS

SetProtectedResourceUrlToSingleResourceEndpoint

Set protected resource URL

protected_resource_url

https://mtls.fapi.panva.cz/accounts

2021-07-01 15:28:09

(1) More

SUCCESS

ExtractTLSTestValuesFromResourceConfiguration

Extracted TLS information from resource endpoint

resource_endpoint

{
  "testHost": "mtls.fapi.panva.cz",
  "testPort": 443
}

2021-07-01 15:28:09

(2) More

SUCCESS

ExtractTLSTestValuesFromOBResourceConfiguration

Extracted TLS information from resource endpoint

accounts_resource_endpoint	{ "testHost": "mtls.fapi.panva.cz", "testPort": 443 }
accounts_request_endpoint	{ "testHost": "mtls.fapi.panva.cz", "testPort": 443 }

2021-07-01 15:28:09		fapi1-advanced-final-ensure-request-object-with-multiple-aud-succeeds Setup Done

Make request to authorization endpoint

2021-07-01 15:28:09

(3) More

SUCCESS

CreateAuthorizationEndpointRequestFromClientInformation

Created authorization endpoint request

client_id	mtls-one
redirect_uri	https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback
scope	openid offline_access

2021-07-01 15:28:09

(1) More

SUCCESS

AddAcrClaimToAuthorizationEndpointRequest

Added acr claim to authorization_endpoint_request

authorization_endpoint_request

{
  "client_id": "mtls-one",
  "redirect_uri": "https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback",
  "scope": "openid offline_access",
  "claims": {
    "id_token": {
      "acr": {
        "value": "urn:mace:incommon:iap:silver",
        "essential": true
      }
    }
  }
}

2021-07-01 15:28:09

(2) More

CreateRandomStateValue

Created state value

requested_state_length	10
state	YSN6mx7XBR

2021-07-01 15:28:09

(5) More

SUCCESS

AddStateToAuthorizationEndpointRequest

Added state parameter to request

client_id	mtls-one
redirect_uri	https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback
scope	openid offline_access
claims	{ "id_token": { "acr": { "value": "urn:mace:incommon:iap:silver", "essential": true } } }
state	YSN6mx7XBR

2021-07-01 15:28:09

(2) More

CreateRandomNonceValue

Created nonce value

requested_nonce_length	10
nonce	EXfRQELVuV

2021-07-01 15:28:09

(6) More

SUCCESS

AddNonceToAuthorizationEndpointRequest

Added nonce parameter to request

client_id	mtls-one
redirect_uri	https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback
scope	openid offline_access
claims	{ "id_token": { "acr": { "value": "urn:mace:incommon:iap:silver", "essential": true } } }
state	YSN6mx7XBR
nonce	EXfRQELVuV

2021-07-01 15:28:09

(7) More

SUCCESS

SetAuthorizationEndpointRequestResponseTypeToCode

Added response_type parameter to request

client_id	mtls-one
redirect_uri	https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback
scope	openid offline_access
claims	{ "id_token": { "acr": { "value": "urn:mace:incommon:iap:silver", "essential": true } } }
state	YSN6mx7XBR
nonce	EXfRQELVuV
response_type	code

2021-07-01 15:28:09

(8) More

SUCCESS

SetAuthorizationEndpointRequestResponseModeToJWT

Added response_mode parameter to request

client_id	mtls-one
redirect_uri	https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback
scope	openid offline_access
claims	{ "id_token": { "acr": { "value": "urn:mace:incommon:iap:silver", "essential": true } } }
state	YSN6mx7XBR
nonce	EXfRQELVuV
response_type	code
response_mode	jwt

2021-07-01 15:28:09

(1) More

SUCCESS

ConvertAuthorizationEndpointRequestToRequestObject

Created request object claims

request_object_claims

{
  "client_id": "mtls-one",
  "redirect_uri": "https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback",
  "scope": "openid offline_access",
  "claims": {
    "id_token": {
      "acr": {
        "value": "urn:mace:incommon:iap:silver",
        "essential": true
      }
    }
  },
  "state": "YSN6mx7XBR",
  "nonce": "EXfRQELVuV",
  "response_type": "code",
  "response_mode": "jwt"
}

2021-07-01 15:28:09

(1) More

SUCCESS

FAPI1-ADV-5.2.2-17

AddNbfToRequestObject

Added nbf to request object claims

nbf	1.625153289E9

2021-07-01 15:28:09

(1) More

SUCCESS

FAPI1-ADV-5.2.2-13

AddExpToRequestObject

Added exp to request object claims

exp	1.625153589E9

2021-07-01 15:28:09

(1) More

SUCCESS

RFC7519-4.1.3

AddMultipleAudToRequestObject

Added multiple aud to request object claims

aud	[ "https://fapi.panva.cz", "https://other1.example.com", "invalid" ]

2021-07-01 15:28:09

(1) More

SUCCESS

OIDCC-6.1

AddIssToRequestObject

Added iss to request object claims

iss

mtls-one

2021-07-01 15:28:09

(1) More

SUCCESS

FAPI1-ADV-5.2.3-8

AddClientIdToRequestObject

Added client_id to request object claims

client_id

mtls-one

2021-07-01 15:28:09

(4) More

SUCCESS

SignRequestObject

Signed the request object

claims	{"aud":["https:\/\/fapi.panva.cz","https:\/\/other1.example.com","invalid"],"nbf":1625153289,"scope":"openid offline_access","claims":{"id_token":{"acr":{"value":"urn:mace:incommon:iap:silver","essential":true}}},"iss":"mtls-one","response_type":"code","redirect_uri":"https:\/\/www.certification.openid.net\/test\/a\/oidc-provider-by_value-mtls-plain_fapi-jarm\/callback","state":"YSN6mx7XBR","exp":1625153589,"nonce":"EXfRQELVuV","client_id":"mtls-one","response_mode":"jwt"}
header	{"kid":"rxZogVFbs1tz36D4tmlW0yEHUTfD_mxyF3RSWBe5eHI","alg":"PS256"}
request_object	eyJraWQiOiJyeFpvZ1ZGYnMxdHozNkQ0dG1sVzB5RUhVVGZEX214eUYzUlNXQmU1ZUhJIiwiYWxnIjoiUFMyNTYifQ.eyJhdWQiOlsiaHR0cHM6XC9cL2ZhcGkucGFudmEuY3oiLCJodHRwczpcL1wvb3RoZXIxLmV4YW1wbGUuY29tIiwiaW52YWxpZCJdLCJuYmYiOjE2MjUxNTMyODksInNjb3BlIjoib3BlbmlkIG9mZmxpbmVfYWNjZXNzIiwiY2xhaW1zIjp7ImlkX3Rva2VuIjp7ImFjciI6eyJ2YWx1ZSI6InVybjptYWNlOmluY29tbW9uOmlhcDpzaWx2ZXIiLCJlc3NlbnRpYWwiOnRydWV9fX0sImlzcyI6Im10bHMtb25lIiwicmVzcG9uc2VfdHlwZSI6ImNvZGUiLCJyZWRpcmVjdF91cmkiOiJodHRwczpcL1wvd3d3LmNlcnRpZmljYXRpb24ub3BlbmlkLm5ldFwvdGVzdFwvYVwvb2lkYy1wcm92aWRlci1ieV92YWx1ZS1tdGxzLXBsYWluX2ZhcGktamFybVwvY2FsbGJhY2siLCJzdGF0ZSI6IllTTjZteDdYQlIiLCJleHAiOjE2MjUxNTM1ODksIm5vbmNlIjoiRVhmUlFFTFZ1ViIsImNsaWVudF9pZCI6Im10bHMtb25lIiwicmVzcG9uc2VfbW9kZSI6Imp3dCJ9.nZIq3e4W3T_Q0O7O1CH4A06B7PITjcvnJFkHZEVuJZoZKAcHdaeU5TIJv67b48lFoE3dgotlhiqNK8pC7F4BHrekOpFyQu4TJ1mRNSCS4L7rmxhsFBqBVD9AvCNplmUR_aXpCZOcWX9PrJQVI-WjlUD0vMJydF7GfPZ5TKW4HW2lIlI-Vyv8UIkw2tenZjezouWBFEd-anj1RtGHfP2g0yP-M7848TLfXjPW1V39mIp6askhVHnQTZQKgDzWn7mFF592xyhc4uh9uRh6ZnulRbIoblSYLHY1WkNUJJWEjGKbl0DexeG04hH-BX5toEQBwrIvtdbaDsN9mj-aMPRRpA
key	{"d":"quAXoet3373KFbGBoz2AgOFA7vcji1j4g5OEcCHmtUhrA2h_q8Vl1wavtqJ-00WdISAbabt7GACDiivzM8I0kd8mBSCrgR26jwmfCgCWydVXLgd44w1MZcUwVbeE8xC38PGJ4XnEYVs7r0OQQInrwtXl_d1BzDYFVVYAQ43-p_1SGASfHv052IJjPKgePFoeheT1xVNS1fCZTSWmFEVPXhbY_LQpnm8DwkR5-hmX-oSjjaJHQoHh4OP8uJ25YAwoMs3-7QOardbEu_DsseeWoQ1MRjnovDWxsxCWa-XTMIPrwF4zP4y-WbtVFILFH7e5fo2WLd5vYSxjOJkiW3TSJQ","e":"AQAB","use":"sig","kid":"rxZogVFbs1tz36D4tmlW0yEHUTfD_mxyF3RSWBe5eHI","x5c":["MIIC4DCCAcgCCQDuBF1vmG5mlDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwHhcNMTkwNjE4MTIzMTA2WhcNMjAwNjE3MTIzMTA2WjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH\/PHwrJvX42AHGeXCZJDSXzuRH934\/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp\/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFGKYDieCWZ63Fx9jMhtlPlHUgkR6bmKqGwvZuVAe9Zz+sHvbVtTk\/4AEOjSozksxf070O1PnK3zY0SuZynhKJnTaFouN45iMnnNQS6XMKd9Tm5WpSRbxfaOeuIZybvOmNy0nuxkvqcE5fXIyr9bDCO9WEArQIQqjGJ93zKJpV2nT9Q7heTK430z7Hp3+XxwGXoKsLW\/jebr3ryWTMEv8ouEbXeCz2OH6Oup8UIwXDyjYxwhwS5FAcRQdh4KnhHOLGYVAuVR3wPewtrTioYznFdfwtDHGd9fZVxrXPlVqCksj0CTnPf7UgXtjm2hTfkwHHtW2BegWR\/q3+q9gs7uehc="],"dp":"ivnkC2VL2tcyS3op5MBF95Vk77qIrl9xX_RloFfHGPEaB8q7l5EfhRAQzs9VAuJejsjhv7SxbeUfmtYQp55NgP44FdDJjc73SqWugyvvcbhxmdslFQxLkBSnydwpGCav0Sz9RqmLLk7iuO1PPQQHoeAGm-wTEILcaqT6uLf7HK8","dq":"TpZaFi6YTiNKuOeKCHrUzTKDTvc2hU4W92VsNHDgi25V_Od8ZdaHPa6Xngs4CZ56TseRrOVxjQBDDKagwLq-GgNWaJ-irGQvDISFj2Y8zWAcnntMLLzKvTAvYdTC64r1gnRBD5RmCDetqu-RdhfQRaf4zoEqMmRlz-dUER1p-KU","n":"xBJ1vPOR6ftkO5figrSjzsHzyFTiyrIYMoFiAFwvM-UypwNTfamwdgb6Q6VlCnV62Lgc1nDR_zx8Kyb1-NgBxnlwmSQ0l87kR_d-P34zEB0xSarqD-K84lJUSX0_qcCXLr4MYBiyOcYMzag-4GWaf_S1ZuTnV1NaaEL4lHpfocFeXok9a9XznuSzol5C8Kd5AS5ahq7UTxSCGvttKpL5xYeWXJ0Zjpptr3AJyOzmjXNq0ix1W75BbmPJjBMfK7bYatHUMsstVHLnYt3CwiNsfD8dKkBVKlh-C4DWo-1WY5VNTTxPC47Ejy2rGbDLJ9MLdtn6Pr-WyW2mdzd0EKjNFQ","p":"4ZNvp0u6vXQAf7IGESuhu3u4cD6K8iJ6BT-O64yHJzc17e9lt-p89GasTtkgeEH_lr-XxScVBYndi_8vaqsA47bkIoWVvcXq7C4jkv0bPelpaI_KPGfoZC1etR102-dS1ZufxzwSo64drw-HPuwaIkXvmpK4MBI9jEYoOHh9KR8","kty":"RSA","x5t#S256":"E-TFTHXRZVsBSvZ5p5mc7ZZMle2Urpv9yr9PdGcOqXQ","q":"3oRU_iCWvKOGHlR9BmcBysVGmkvBwj8XLTJGfxJkm3M9utLSg0uNo7vW0Zm88KdzdeaRBt6ltZAG3hBL0mHNwC0hYRv5fzO7yczWFLPXbUNVqC5OLI-wTL7-ikx040lL9IRRtgub47-9IvxxaGaIRzsFwa-15D7TCE7K8BydH0s","qi":"ITLsaxLewCPcaJOYKRW9HeApKVIqYlQuYj7wShPq3NiEy_KqgIc-2WXYMfMF6oDoiXYMrP6AVsqWfb4us9StvauAr17yp1kf1ffpazy71gD9VqwZBFQUgBwVw1agEFfv2cFD_z3Os-5to3ZGH0Eq5QQYsoDMN_UkjOx5SvyN2_A","alg":"PS256"}

2021-07-01 15:28:09

(1) More

SUCCESS

BuildRequestObjectByValueRedirectToAuthorizationEndpoint

Sending to authorization endpoint

redirect_to_authorization_endpoint

https://fapi.panva.cz/auth?request=eyJraWQiOiJyeFpvZ1ZGYnMxdHozNkQ0dG1sVzB5RUhVVGZEX214eUYzUlNXQmU1ZUhJIiwiYWxnIjoiUFMyNTYifQ.eyJhdWQiOlsiaHR0cHM6XC9cL2ZhcGkucGFudmEuY3oiLCJodHRwczpcL1wvb3RoZXIxLmV4YW1wbGUuY29tIiwiaW52YWxpZCJdLCJuYmYiOjE2MjUxNTMyODksInNjb3BlIjoib3BlbmlkIG9mZmxpbmVfYWNjZXNzIiwiY2xhaW1zIjp7ImlkX3Rva2VuIjp7ImFjciI6eyJ2YWx1ZSI6InVybjptYWNlOmluY29tbW9uOmlhcDpzaWx2ZXIiLCJlc3NlbnRpYWwiOnRydWV9fX0sImlzcyI6Im10bHMtb25lIiwicmVzcG9uc2VfdHlwZSI6ImNvZGUiLCJyZWRpcmVjdF91cmkiOiJodHRwczpcL1wvd3d3LmNlcnRpZmljYXRpb24ub3BlbmlkLm5ldFwvdGVzdFwvYVwvb2lkYy1wcm92aWRlci1ieV92YWx1ZS1tdGxzLXBsYWluX2ZhcGktamFybVwvY2FsbGJhY2siLCJzdGF0ZSI6IllTTjZteDdYQlIiLCJleHAiOjE2MjUxNTM1ODksIm5vbmNlIjoiRVhmUlFFTFZ1ViIsImNsaWVudF9pZCI6Im10bHMtb25lIiwicmVzcG9uc2VfbW9kZSI6Imp3dCJ9.nZIq3e4W3T_Q0O7O1CH4A06B7PITjcvnJFkHZEVuJZoZKAcHdaeU5TIJv67b48lFoE3dgotlhiqNK8pC7F4BHrekOpFyQu4TJ1mRNSCS4L7rmxhsFBqBVD9AvCNplmUR_aXpCZOcWX9PrJQVI-WjlUD0vMJydF7GfPZ5TKW4HW2lIlI-Vyv8UIkw2tenZjezouWBFEd-anj1RtGHfP2g0yP-M7848TLfXjPW1V39mIp6askhVHnQTZQKgDzWn7mFF592xyhc4uh9uRh6ZnulRbIoblSYLHY1WkNUJJWEjGKbl0DexeG04hH-BX5toEQBwrIvtdbaDsN9mj-aMPRRpA&client_id=mtls-one&redirect_uri=https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback&scope=openid%20offline_access&response_type=code

2021-07-01 15:28:09

(1) More

REDIRECT

fapi1-advanced-final-ensure-request-object-with-multiple-aud-succeeds

Redirecting to authorization endpoint

redirect_to

https://fapi.panva.cz/auth?request=eyJraWQiOiJyeFpvZ1ZGYnMxdHozNkQ0dG1sVzB5RUhVVGZEX214eUYzUlNXQmU1ZUhJIiwiYWxnIjoiUFMyNTYifQ.eyJhdWQiOlsiaHR0cHM6XC9cL2ZhcGkucGFudmEuY3oiLCJodHRwczpcL1wvb3RoZXIxLmV4YW1wbGUuY29tIiwiaW52YWxpZCJdLCJuYmYiOjE2MjUxNTMyODksInNjb3BlIjoib3BlbmlkIG9mZmxpbmVfYWNjZXNzIiwiY2xhaW1zIjp7ImlkX3Rva2VuIjp7ImFjciI6eyJ2YWx1ZSI6InVybjptYWNlOmluY29tbW9uOmlhcDpzaWx2ZXIiLCJlc3NlbnRpYWwiOnRydWV9fX0sImlzcyI6Im10bHMtb25lIiwicmVzcG9uc2VfdHlwZSI6ImNvZGUiLCJyZWRpcmVjdF91cmkiOiJodHRwczpcL1wvd3d3LmNlcnRpZmljYXRpb24ub3BlbmlkLm5ldFwvdGVzdFwvYVwvb2lkYy1wcm92aWRlci1ieV92YWx1ZS1tdGxzLXBsYWluX2ZhcGktamFybVwvY2FsbGJhY2siLCJzdGF0ZSI6IllTTjZteDdYQlIiLCJleHAiOjE2MjUxNTM1ODksIm5vbmNlIjoiRVhmUlFFTFZ1ViIsImNsaWVudF9pZCI6Im10bHMtb25lIiwicmVzcG9uc2VfbW9kZSI6Imp3dCJ9.nZIq3e4W3T_Q0O7O1CH4A06B7PITjcvnJFkHZEVuJZoZKAcHdaeU5TIJv67b48lFoE3dgotlhiqNK8pC7F4BHrekOpFyQu4TJ1mRNSCS4L7rmxhsFBqBVD9AvCNplmUR_aXpCZOcWX9PrJQVI-WjlUD0vMJydF7GfPZ5TKW4HW2lIlI-Vyv8UIkw2tenZjezouWBFEd-anj1RtGHfP2g0yP-M7848TLfXjPW1V39mIp6askhVHnQTZQKgDzWn7mFF592xyhc4uh9uRh6ZnulRbIoblSYLHY1WkNUJJWEjGKbl0DexeG04hH-BX5toEQBwrIvtdbaDsN9mj-aMPRRpA&client_id=mtls-one&redirect_uri=https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback&scope=openid%20offline_access&response_type=code

2021-07-01 15:28:09

(3) More

WebRunner

Scripted browser HTTP request

browser

goToUrl

request_method

GET

request_uri

https://fapi.panva.cz/auth?request=eyJraWQiOiJyeFpvZ1ZGYnMxdHozNkQ0dG1sVzB5RUhVVGZEX214eUYzUlNXQmU1ZUhJIiwiYWxnIjoiUFMyNTYifQ.eyJhdWQiOlsiaHR0cHM6XC9cL2ZhcGkucGFudmEuY3oiLCJodHRwczpcL1wvb3RoZXIxLmV4YW1wbGUuY29tIiwiaW52YWxpZCJdLCJuYmYiOjE2MjUxNTMyODksInNjb3BlIjoib3BlbmlkIG9mZmxpbmVfYWNjZXNzIiwiY2xhaW1zIjp7ImlkX3Rva2VuIjp7ImFjciI6eyJ2YWx1ZSI6InVybjptYWNlOmluY29tbW9uOmlhcDpzaWx2ZXIiLCJlc3NlbnRpYWwiOnRydWV9fX0sImlzcyI6Im10bHMtb25lIiwicmVzcG9uc2VfdHlwZSI6ImNvZGUiLCJyZWRpcmVjdF91cmkiOiJodHRwczpcL1wvd3d3LmNlcnRpZmljYXRpb24ub3BlbmlkLm5ldFwvdGVzdFwvYVwvb2lkYy1wcm92aWRlci1ieV92YWx1ZS1tdGxzLXBsYWluX2ZhcGktamFybVwvY2FsbGJhY2siLCJzdGF0ZSI6IllTTjZteDdYQlIiLCJleHAiOjE2MjUxNTM1ODksIm5vbmNlIjoiRVhmUlFFTFZ1ViIsImNsaWVudF9pZCI6Im10bHMtb25lIiwicmVzcG9uc2VfbW9kZSI6Imp3dCJ9.nZIq3e4W3T_Q0O7O1CH4A06B7PITjcvnJFkHZEVuJZoZKAcHdaeU5TIJv67b48lFoE3dgotlhiqNK8pC7F4BHrekOpFyQu4TJ1mRNSCS4L7rmxhsFBqBVD9AvCNplmUR_aXpCZOcWX9PrJQVI-WjlUD0vMJydF7GfPZ5TKW4HW2lIlI-Vyv8UIkw2tenZjezouWBFEd-anj1RtGHfP2g0yP-M7848TLfXjPW1V39mIp6askhVHnQTZQKgDzWn7mFF592xyhc4uh9uRh6ZnulRbIoblSYLHY1WkNUJJWEjGKbl0DexeG04hH-BX5toEQBwrIvtdbaDsN9mj-aMPRRpA&client_id=mtls-one&redirect_uri=https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback&scope=openid%20offline_access&response_type=code

2021-07-01 15:28:10

(4) More

RESPONSE

WebRunner

Scripted browser HTTP response

response_content	<!DOCTYPE html> <html > <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Sign-in</title> <style> @import url(https://fonts.googleapis.com/css?family=Roboto:400,100); body { font-family: 'Roboto', sans-serif; margin-top: 25px; margin-bottom: 25px; } .login-card { padding: 40px; padding-top: 0px; padding-bottom: 10px; width: 274px; background-color: #F7F7F7; margin: 0 auto 10px; border-radius: 2px; box-shadow: 0px 2px 2px rgba(0, 0, 0, 0.3); overflow: hidden; } .login-card + .login-card { padding-top: 10px; } .login-card h1 { font-weight: 100; text-align: center; font-size: 2.3em; } .login-card [type=submit] { width: 100%; display: block; margin-bottom: 10px; position: relative; } .login-card input[type=text], input[type=email], input[type=password] { height: 44px; font-size: 16px; width: 100%; margin-bottom: 10px; -webkit-appearance: none; background: #fff; border: 1px solid #d9d9d9; border-top: 1px solid #c0c0c0; padding: 0 8px; box-sizing: border-box; -moz-box-sizing: border-box; } .login { text-align: center; font-size: 14px; font-family: 'Arial', sans-serif; font-weight: 700; height: 36px; padding: 0 8px; } .login-submit { border: 0px; color: #fff; text-shadow: 0 1px rgba(0,0,0,0.1); background-color: #4d90fe; } .login-card a { text-decoration: none; color: #666; font-weight: 400; text-align: center; display: inline-block; opacity: 0.6; } .login-help { width: 100%; text-align: center; font-size: 12px; } .login-client-image img { margin-bottom: 20px; display: block; margin-left: auto; margin-right: auto; width: 20%; } .login-card input[type=checkbox] { margin-bottom: 10px; } .login-card label { color: #999; } .grant-debug { text-align: center; font-family: Fixed, monospace; width: 100%; font-size: 12px; color: #999; } .grant-debug div { padding-top: 10px; } ul { font-weight: 100; padding-left: 1em; list-style-type: circle; } li + ul, ul + li, li + li { padding-top: 0.3em; } button { cursor: pointer; } </style> </head> <body> <div class="login-card"> <h1>Sign-in</h1> <form autocomplete="off" action="https://fapi.panva.cz/interaction/ypMrinYElcPmn95OjLVej" method="post"> <input type="hidden" name="prompt" value="login"/> <input required type="text" name="login" placeholder="Enter any login" autofocus="on"> <input required type="password" name="password" placeholder="and password" > <button type="submit" class="login login-submit">Sign-in</button> </form> <div class="login-help"> <a href="https://fapi.panva.cz/interaction/ypMrinYElcPmn95OjLVej/abort">[ Cancel ]</a> </div> </div> <div class="grant-debug"> <details> <summary style="text-align: center;">(Click to expand) DEBUG information</summary> <div> <strong>uid</strong>: ypMrinYElcPmn95OjLVej </div> <div> PARAMS <br> ======== <br> <strong>acr_values</strong>: 'urn:mace:incommon:iap:silver'<br/><strong>client_id</strong>: 'mtls-one'<br/><strong>nonce</strong>: 'EXfRQELVuV'<br/><strong>redirect_uri</strong>: 'https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback'<br/><strong>response_mode</strong>: 'jwt'<br/><strong>response_type</strong>: 'code'<br/><strong>scope</strong>: 'openid'<br/><strong>state</strong>: 'YSN6mx7XBR' </div> <div> PROMPT <br> ======== <br> <strong>name</strong>: 'login'<br/><strong>reasons</strong>: [ 'no_session' ]<br/><strong>details</strong>: {} </div> </details> </div> </body> </html>
response_content_type	text/html
response_status_text	200-OK
response_status_code	200

2021-07-01 15:28:10

(6) More

INFO

WebRunner

Entering text

task	Login
browser	text
element_type	name
value	foo
url	https://fapi.panva.cz/interaction/ypMrinYElcPmn95OjLVej
target	login

2021-07-01 15:28:10

(6) More

INFO

WebRunner

Entering text

task	Login
browser	text
element_type	name
value	bar
url	https://fapi.panva.cz/interaction/ypMrinYElcPmn95OjLVej
target	password

2021-07-01 15:28:10

(5) More

INFO

WebRunner

Clicking an element

task	Login
browser	click
element_type	class
url	https://fapi.panva.cz/interaction/ypMrinYElcPmn95OjLVej
target	login-submit

2021-07-01 15:28:10

(6) More

INFO

WebRunner

Completed processing of webpage

task	Login
browser	complete
response_status_text	200-OK
match	https://fapi.panva.cz/interaction*
url	https://fapi.panva.cz/interaction/QPUP4t2Zf13nXjUZXmeax
response_status_code	200

2021-07-01 15:28:10

(5) More

INFO

WebRunner

Clicking an element

task	Consent
browser	click
element_type	class
url	https://fapi.panva.cz/interaction/QPUP4t2Zf13nXjUZXmeax
target	login-submit

2021-07-01 15:28:11

(7) More

INCOMING

fapi1-advanced-final-ensure-request-object-with-multiple-aud-succeeds

Incoming HTTP request to test instance l32I7w1GMXqo87L

incoming_headers	{ "host": "www.certification.openid.net", "upgrade-insecure-requests": "1", "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Safari/537.36", "accept": "text/html,application/xhtml+xml,application/xml;q\u003d0.9,image/avif,image/webp,image/apng,/;q\u003d0.8,application/signed-exchange;v\u003db3;q\u003d0.9", "sec-fetch-site": "same-origin", "sec-fetch-mode": "navigate", "sec-fetch-user": "?1", "sec-fetch-dest": "document", "referer": "https://fapi.panva.cz/interaction/QPUP4t2Zf13nXjUZXmeax", "accept-encoding": "gzip, deflate, br", "accept-language": "en-US,en;q\u003d0.9", "origin": "https://fapi.panva.cz", "cache-control": "max-age\u003d0", "x-ssl-cipher": "ECDHE-RSA-AES256-GCM-SHA384", "x-ssl-protocol": "TLSv1.2", "connection": "close", "x-forwarded-host": "www.certification.openid.net", "x-forwarded-server": "www.certification.openid.net" }
incoming_path	callback
incoming_body_form_params
incoming_method	GET
incoming_body_json
incoming_query_string_params	{ "response": "eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJjb2RlIjoiX2dySHdwbnZYczNndW5KckJ4ZEJia0FCa0ZHaU44ZW1fNVZnWTQyeFBWVSIsInN0YXRlIjoiWVNONm14N1hCUiIsImF1ZCI6Im10bHMtb25lIiwiZXhwIjoxNjI1MTUzNDExLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.fW2L3GzGiyMgvALbREFYImf6D2pg6z-t0zKfmKxfKE-GN7U570S0a4my8GhRLT0ikrp2Ua3FlDh8QqxcY5DJzO3ltROdRfgXpmDGRLHDx3mEHzPsv7w_aFVO6hS844aMVQuv2eJBaRg2pTcGfNjAwyCjgLJ6dFkECXn4EISaSI6Al6hB76Uu8zyOM4a-yHouSsl6Fsoi3lhCu3Fgh0cwjFgX6vk2E3iQFuXhNIYnz6O2B_8FlzDWK6chn6x9iUpc3W71K2V2hxPkENrb4bRR46xaG9D0QqGcRzilN29B4-rE5nWW_qwRe_AX86one2s_C1wyqIVmm9qdGCEM6BnTAw" }
incoming_body

2021-07-01 15:28:11

(1) More

SUCCESS

CreateRandomImplicitSubmitUrl

Created random implicit submission URL

implicit_submit

{
  "path": "implicit/HDKXrBt6kb3UldS2N1Vs",
  "fullUrl": "https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/implicit/HDKXrBt6kb3UldS2N1Vs"
}

2021-07-01 15:28:11

(2) More

OUTGOING

fapi1-advanced-final-ensure-request-object-with-multiple-aud-succeeds

Response to HTTP request to test instance l32I7w1GMXqo87L

outgoing

ModelAndView [view="implicitCallback"; model={implicitSubmitUrl=https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/implicit/HDKXrBt6kb3UldS2N1Vs, returnUrl=/log-detail.html?log=l32I7w1GMXqo87L}]

outgoing_path

callback

2021-07-01 15:28:11

(6) More

INFO

WebRunner

Completed processing of webpage

task	Consent
browser	complete
response_status_text	200-
match	https://fapi.panva.cz/interaction*
url	https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback?response=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJjb2RlIjoiX2dySHdwbnZYczNndW5KckJ4ZEJia0FCa0ZHaU44ZW1fNVZnWTQyeFBWVSIsInN0YXRlIjoiWVNONm14N1hCUiIsImF1ZCI6Im10bHMtb25lIiwiZXhwIjoxNjI1MTUzNDExLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.fW2L3GzGiyMgvALbREFYImf6D2pg6z-t0zKfmKxfKE-GN7U570S0a4my8GhRLT0ikrp2Ua3FlDh8QqxcY5DJzO3ltROdRfgXpmDGRLHDx3mEHzPsv7w_aFVO6hS844aMVQuv2eJBaRg2pTcGfNjAwyCjgLJ6dFkECXn4EISaSI6Al6hB76Uu8zyOM4a-yHouSsl6Fsoi3lhCu3Fgh0cwjFgX6vk2E3iQFuXhNIYnz6O2B_8FlzDWK6chn6x9iUpc3W71K2V2hxPkENrb4bRR46xaG9D0QqGcRzilN29B4-rE5nWW_qwRe_AX86one2s_C1wyqIVmm9qdGCEM6BnTAw
response_status_code	200

2021-07-01 15:28:11

(8) More

INFO

WebRunner

Waiting

regexp
seconds	10
task	Verify Complete
browser	wait
action
element_type	id
url	https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback?response=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJjb2RlIjoiX2dySHdwbnZYczNndW5KckJ4ZEJia0FCa0ZHaU44ZW1fNVZnWTQyeFBWVSIsInN0YXRlIjoiWVNONm14N1hCUiIsImF1ZCI6Im10bHMtb25lIiwiZXhwIjoxNjI1MTUzNDExLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.fW2L3GzGiyMgvALbREFYImf6D2pg6z-t0zKfmKxfKE-GN7U570S0a4my8GhRLT0ikrp2Ua3FlDh8QqxcY5DJzO3ltROdRfgXpmDGRLHDx3mEHzPsv7w_aFVO6hS844aMVQuv2eJBaRg2pTcGfNjAwyCjgLJ6dFkECXn4EISaSI6Al6hB76Uu8zyOM4a-yHouSsl6Fsoi3lhCu3Fgh0cwjFgX6vk2E3iQFuXhNIYnz6O2B_8FlzDWK6chn6x9iUpc3W71K2V2hxPkENrb4bRR46xaG9D0QqGcRzilN29B4-rE5nWW_qwRe_AX86one2s_C1wyqIVmm9qdGCEM6BnTAw
target	submission_complete

2021-07-01 15:28:11

(7) More

INCOMING

fapi1-advanced-final-ensure-request-object-with-multiple-aud-succeeds

Incoming HTTP request to test instance l32I7w1GMXqo87L

incoming_headers	{ "host": "www.certification.openid.net", "upgrade-insecure-requests": "1", "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Safari/537.36", "accept": "/", "sec-fetch-site": "same-origin", "sec-fetch-mode": "navigate", "sec-fetch-user": "?1", "sec-fetch-dest": "document", "referer": "https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback?response\u003deyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJjb2RlIjoiX2dySHdwbnZYczNndW5KckJ4ZEJia0FCa0ZHaU44ZW1fNVZnWTQyeFBWVSIsInN0YXRlIjoiWVNONm14N1hCUiIsImF1ZCI6Im10bHMtb25lIiwiZXhwIjoxNjI1MTUzNDExLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.fW2L3GzGiyMgvALbREFYImf6D2pg6z-t0zKfmKxfKE-GN7U570S0a4my8GhRLT0ikrp2Ua3FlDh8QqxcY5DJzO3ltROdRfgXpmDGRLHDx3mEHzPsv7w_aFVO6hS844aMVQuv2eJBaRg2pTcGfNjAwyCjgLJ6dFkECXn4EISaSI6Al6hB76Uu8zyOM4a-yHouSsl6Fsoi3lhCu3Fgh0cwjFgX6vk2E3iQFuXhNIYnz6O2B_8FlzDWK6chn6x9iUpc3W71K2V2hxPkENrb4bRR46xaG9D0QqGcRzilN29B4-rE5nWW_qwRe_AX86one2s_C1wyqIVmm9qdGCEM6BnTAw", "accept-encoding": "gzip, deflate, br", "accept-language": "en-US,en;q\u003d0.9", "cookie": "JSESSIONID\u003d937C1FDC56A0FEF091A35D72E94B92A8", "x-requested-with": "XMLHttpRequest", "content-type": "text/plain", "x-ssl-cipher": "ECDHE-RSA-AES256-GCM-SHA384", "x-ssl-protocol": "TLSv1.2", "content-length": "0", "x-forwarded-host": "www.certification.openid.net", "x-forwarded-server": "www.certification.openid.net", "connection": "close" }
incoming_path	implicit/HDKXrBt6kb3UldS2N1Vs
incoming_body_form_params
incoming_method	POST
incoming_body_json
incoming_query_string_params	{}
incoming_body

2021-07-01 15:28:11

(4) More

OUTGOING

fapi1-advanced-final-ensure-request-object-with-multiple-aud-succeeds

Response to HTTP request to test instance l32I7w1GMXqo87L

outgoing_status_code	204
outgoing_headers	{}
outgoing_body
outgoing_path	implicit/HDKXrBt6kb3UldS2N1Vs

2021-07-01 15:28:11	SUCCESS	ExtractImplicitHashToCallbackResponse implicit_hash is empty

2021-07-01 15:28:11

(5) More

REDIRECT-IN

fapi1-advanced-final-ensure-request-object-with-multiple-aud-succeeds

Authorization endpoint response captured

url_query	{ "response": "eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJjb2RlIjoiX2dySHdwbnZYczNndW5KckJ4ZEJia0FCa0ZHaU44ZW1fNVZnWTQyeFBWVSIsInN0YXRlIjoiWVNONm14N1hCUiIsImF1ZCI6Im10bHMtb25lIiwiZXhwIjoxNjI1MTUzNDExLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.fW2L3GzGiyMgvALbREFYImf6D2pg6z-t0zKfmKxfKE-GN7U570S0a4my8GhRLT0ikrp2Ua3FlDh8QqxcY5DJzO3ltROdRfgXpmDGRLHDx3mEHzPsv7w_aFVO6hS844aMVQuv2eJBaRg2pTcGfNjAwyCjgLJ6dFkECXn4EISaSI6Al6hB76Uu8zyOM4a-yHouSsl6Fsoi3lhCu3Fgh0cwjFgX6vk2E3iQFuXhNIYnz6O2B_8FlzDWK6chn6x9iUpc3W71K2V2hxPkENrb4bRR46xaG9D0QqGcRzilN29B4-rE5nWW_qwRe_AX86one2s_C1wyqIVmm9qdGCEM6BnTAw" }
headers	{ "host": "www.certification.openid.net", "upgrade-insecure-requests": "1", "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Safari/537.36", "accept": "text/html,application/xhtml+xml,application/xml;q\u003d0.9,image/avif,image/webp,image/apng,/;q\u003d0.8,application/signed-exchange;v\u003db3;q\u003d0.9", "sec-fetch-site": "same-origin", "sec-fetch-mode": "navigate", "sec-fetch-user": "?1", "sec-fetch-dest": "document", "referer": "https://fapi.panva.cz/interaction/QPUP4t2Zf13nXjUZXmeax", "accept-encoding": "gzip, deflate, br", "accept-language": "en-US,en;q\u003d0.9", "origin": "https://fapi.panva.cz", "cache-control": "max-age\u003d0", "x-ssl-cipher": "ECDHE-RSA-AES256-GCM-SHA384", "x-ssl-protocol": "TLSv1.2", "connection": "close", "x-forwarded-host": "www.certification.openid.net", "x-forwarded-server": "www.certification.openid.net" }
http_method	GET
url_fragment	{}
post_body

Verify authorization endpoint response

2021-07-01 15:28:11

(3) More

SUCCESS

FAPI1-ADV-5.2.3.2-1 JARM-4.3.4 JARM-4.3.1

ExtractJARMFromURLQuery

Found and parsed the jarm_response from callback_query_params

value	eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJjb2RlIjoiX2dySHdwbnZYczNndW5KckJ4ZEJia0FCa0ZHaU44ZW1fNVZnWTQyeFBWVSIsInN0YXRlIjoiWVNONm14N1hCUiIsImF1ZCI6Im10bHMtb25lIiwiZXhwIjoxNjI1MTUzNDExLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.fW2L3GzGiyMgvALbREFYImf6D2pg6z-t0zKfmKxfKE-GN7U570S0a4my8GhRLT0ikrp2Ua3FlDh8QqxcY5DJzO3ltROdRfgXpmDGRLHDx3mEHzPsv7w_aFVO6hS844aMVQuv2eJBaRg2pTcGfNjAwyCjgLJ6dFkECXn4EISaSI6Al6hB76Uu8zyOM4a-yHouSsl6Fsoi3lhCu3Fgh0cwjFgX6vk2E3iQFuXhNIYnz6O2B_8FlzDWK6chn6x9iUpc3W71K2V2hxPkENrb4bRR46xaG9D0QqGcRzilN29B4-rE5nWW_qwRe_AX86one2s_C1wyqIVmm9qdGCEM6BnTAw
header	{ "kid": "EUsMLFwXz5zMhkJoo1lcnIM2pApLc3kc_2WV8YKYC3M", "typ": "JWT", "alg": "PS256" }
claims	{ "aud": "mtls-one", "code": "_grHwpnvXs3gunJrBxdBbkABkFGiN8em_5VgY42xPVU", "iss": "https://fapi.panva.cz", "state": "YSN6mx7XBR", "exp": 1625153411 }

2021-07-01 15:28:11	SUCCESS JARM-4.1	RejectNonJarmResponsesInUrlQuery Authorization endpoint response only includes the JARM JWT.

2021-07-01 15:28:11

(2) More

SUCCESS

ExtractAuthorizationEndpointResponseFromJARMResponse

Extracted the authorization response

code	_grHwpnvXs3gunJrBxdBbkABkFGiN8em_5VgY42xPVU
state	YSN6mx7XBR

2021-07-01 15:28:11	SUCCESS JARM-4.4-5 JARM-4.4-4 JARM-4.4-3	ValidateJARMResponse JARM response standard JWT claims are valid

2021-07-01 15:28:11

(2) More

SUCCESS

JARM-4.1

ValidateJARMExpRecommendations

JARM response 'exp' is less than 10 minutes

now	"Jul 1, 2021, 3:28:11 PM"
expiration	"Jul 1, 2021, 3:30:11 PM"

2021-07-01 15:28:11

(1) More

SUCCESS

JARM-4.4-6

ValidateJARMSignatureUsingKid

jarm_response signature validated

jarm_response

eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJjb2RlIjoiX2dySHdwbnZYczNndW5KckJ4ZEJia0FCa0ZHaU44ZW1fNVZnWTQyeFBWVSIsInN0YXRlIjoiWVNONm14N1hCUiIsImF1ZCI6Im10bHMtb25lIiwiZXhwIjoxNjI1MTUzNDExLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.fW2L3GzGiyMgvALbREFYImf6D2pg6z-t0zKfmKxfKE-GN7U570S0a4my8GhRLT0ikrp2Ua3FlDh8QqxcY5DJzO3ltROdRfgXpmDGRLHDx3mEHzPsv7w_aFVO6hS844aMVQuv2eJBaRg2pTcGfNjAwyCjgLJ6dFkECXn4EISaSI6Al6hB76Uu8zyOM4a-yHouSsl6Fsoi3lhCu3Fgh0cwjFgX6vk2E3iQFuXhNIYnz6O2B_8FlzDWK6chn6x9iUpc3W71K2V2hxPkENrb4bRR46xaG9D0QqGcRzilN29B4-rE5nWW_qwRe_AX86one2s_C1wyqIVmm9qdGCEM6BnTAw

2021-07-01 15:28:11	SUCCESS OIDCC-3.3.2.5	RejectAuthCodeInUrlQuery Authorization code is not present in URL query returned from authorization endpoint

2021-07-01 15:28:11	SUCCESS	CheckMatchingCallbackParameters Callback parameters successfully verified

2021-07-01 15:28:11	SUCCESS OIDCC-3.3.2.5	RejectStateInUrlQueryForHybridFlow state is correctly not present in URL query returned from authorization endpoint (as in the hybrid flow it must be returned in the URL fragment/hash only)

2021-07-01 15:28:11	SUCCESS	CheckIfAuthorizationEndpointError No error from authorization endpoint

2021-07-01 15:28:11

(2) More

SUCCESS

ValidateSuccessfulJARMResponseFromAuthorizationEndpoint

authorization endpoint response does not include unexpected parameters

code	_grHwpnvXs3gunJrBxdBbkABkFGiN8em_5VgY42xPVU
state	YSN6mx7XBR

2021-07-01 15:28:11

(1) More

SUCCESS

OIDCC-3.2.2.5 JARM-4.4-2

CheckStateInAuthorizationResponse

State in response correctly returned

state

YSN6mx7XBR

2021-07-01 15:28:11		ValidateIssInAuthorizationResponse No 'iss' value in authorization response.

2021-07-01 15:28:11

(1) More

SUCCESS

ExtractAuthorizationCodeFromAuthorizationResponse

Found authorization code

code	_grHwpnvXs3gunJrBxdBbkABkFGiN8em_5VgY42xPVU

2021-07-01 15:28:11

(2) More

SUCCESS

RFC6819-5.1.4.2-2 RFC6749-10.10

EnsureMinimumAuthorizationCodeLength

Authorization code is of sufficient length

actual	344
required	128

2021-07-01 15:28:11

(2) More

SUCCESS

RFC6819-5.1.4.2-2 RFC6749-10.10

EnsureMinimumAuthorizationCodeEntropy

Calculated shannon entropy seems sufficient

actual	211.81960944786326
expected	96.0

Call token endpoint

2021-07-01 15:28:11

(3) More

SUCCESS

CreateTokenEndpointRequestForAuthorizationCodeGrant

grant_type	authorization_code
code	_grHwpnvXs3gunJrBxdBbkABkFGiN8em_5VgY42xPVU
redirect_uri	https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback

2021-07-01 15:28:11

(4) More

SUCCESS

AddClientIdToTokenEndpointRequest

grant_type	authorization_code
code	_grHwpnvXs3gunJrBxdBbkABkFGiN8em_5VgY42xPVU
redirect_uri	https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback
client_id	mtls-one

2021-07-01 15:28:11

(5) More

CallTokenEndpoint

HTTP request

request_uri	https://mtls.fapi.panva.cz/token
request_method	POST
request_headers	{ "accept": "application/json;charset\u003dUTF-8", "accept-charset": "utf-8", "content-type": "application/x-www-form-urlencoded;charset\u003dUTF-8", "content-length": "221" }
request_body	grant_type=authorization_code&code=_grHwpnvXs3gunJrBxdBbkABkFGiN8em_5VgY42xPVU&redirect_uri=https%3A%2F%2Fwww.certification.openid.net%2Ftest%2Fa%2Foidc-provider-by_value-mtls-plain_fapi-jarm%2Fcallback&client_id=mtls-one
request_mutual_tls	{ "cert": "MIIC4DCCAcgCCQDuBF1vmG5mlDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwHhcNMTkwNjE4MTIzMTA2WhcNMjAwNjE3MTIzMTA2WjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFGKYDieCWZ63Fx9jMhtlPlHUgkR6bmKqGwvZuVAe9Zz+sHvbVtTk/4AEOjSozksxf070O1PnK3zY0SuZynhKJnTaFouN45iMnnNQS6XMKd9Tm5WpSRbxfaOeuIZybvOmNy0nuxkvqcE5fXIyr9bDCO9WEArQIQqjGJ93zKJpV2nT9Q7heTK430z7Hp3+XxwGXoKsLW/jebr3ryWTMEv8ouEbXeCz2OH6Oup8UIwXDyjYxwhwS5FAcRQdh4KnhHOLGYVAuVR3wPewtrTioYznFdfwtDHGd9fZVxrXPlVqCksj0CTnPf7UgXtjm2hTfkwHHtW2BegWR/q3+q9gs7uehc\u003d", "key": "MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAECggEBAKrgF6Hrd9+9yhWxgaM9gIDhQO73I4tY+IOThHAh5rVIawNof6vFZdcGr7aiftNFnSEgG2m7exgAg4or8zPCNJHfJgUgq4Eduo8JnwoAlsnVVy4HeOMNTGXFMFW3hPMQt/DxieF5xGFbO69DkECJ68LV5f3dQcw2BVVWAEON/qf9UhgEnx79OdiCYzyoHjxaHoXk9cVTUtXwmU0lphRFT14W2Py0KZ5vA8JEefoZl/qEo42iR0KB4eDj/LiduWAMKDLN/u0Dmq3WxLvw7LHnlqENTEY56Lw1sbMQlmvl0zCD68BeMz+Mvlm7VRSCxR+3uX6Nli3eb2EsYziZIlt00iUCgYEA4ZNvp0u6vXQAf7IGESuhu3u4cD6K8iJ6BT+O64yHJzc17e9lt+p89GasTtkgeEH/lr+XxScVBYndi/8vaqsA47bkIoWVvcXq7C4jkv0bPelpaI/KPGfoZC1etR102+dS1ZufxzwSo64drw+HPuwaIkXvmpK4MBI9jEYoOHh9KR8CgYEA3oRU/iCWvKOGHlR9BmcBysVGmkvBwj8XLTJGfxJkm3M9utLSg0uNo7vW0Zm88KdzdeaRBt6ltZAG3hBL0mHNwC0hYRv5fzO7yczWFLPXbUNVqC5OLI+wTL7+ikx040lL9IRRtgub47+9IvxxaGaIRzsFwa+15D7TCE7K8BydH0sCgYEAivnkC2VL2tcyS3op5MBF95Vk77qIrl9xX/RloFfHGPEaB8q7l5EfhRAQzs9VAuJejsjhv7SxbeUfmtYQp55NgP44FdDJjc73SqWugyvvcbhxmdslFQxLkBSnydwpGCav0Sz9RqmLLk7iuO1PPQQHoeAGm+wTEILcaqT6uLf7HK8CgYBOlloWLphOI0q454oIetTNMoNO9zaFThb3ZWw0cOCLblX853xl1oc9rpeeCzgJnnpOx5Gs5XGNAEMMpqDAur4aA1Zon6KsZC8MhIWPZjzNYByee0wsvMq9MC9h1MLrivWCdEEPlGYIN62q75F2F9BFp/jOgSoyZGXP51QRHWn4pQKBgCEy7GsS3sAj3GiTmCkVvR3gKSlSKmJULmI+8EoT6tzYhMvyqoCHPtll2DHzBeqA6Il2DKz+gFbKln2+LrPUrb2rgK9e8qdZH9X36Ws8u9YA/VasGQRUFIAcFcNWoBBX79nBQ/89zrPubaN2Rh9BKuUEGLKAzDf1JIzseUr8jdvw" }

2021-07-01 15:28:12

(6) More

INFO

WebRunner

Completed processing of webpage

task	Verify Complete
browser	complete
response_status_text	200-
match	https:///test/a//callback*
url	https://www.certification.openid.net/test/a/oidc-provider-by_value-mtls-plain_fapi-jarm/callback?response=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJjb2RlIjoiX2dySHdwbnZYczNndW5KckJ4ZEJia0FCa0ZHaU44ZW1fNVZnWTQyeFBWVSIsInN0YXRlIjoiWVNONm14N1hCUiIsImF1ZCI6Im10bHMtb25lIiwiZXhwIjoxNjI1MTUzNDExLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.fW2L3GzGiyMgvALbREFYImf6D2pg6z-t0zKfmKxfKE-GN7U570S0a4my8GhRLT0ikrp2Ua3FlDh8QqxcY5DJzO3ltROdRfgXpmDGRLHDx3mEHzPsv7w_aFVO6hS844aMVQuv2eJBaRg2pTcGfNjAwyCjgLJ6dFkECXn4EISaSI6Al6hB76Uu8zyOM4a-yHouSsl6Fsoi3lhCu3Fgh0cwjFgX6vk2E3iQFuXhNIYnz6O2B_8FlzDWK6chn6x9iUpc3W71K2V2hxPkENrb4bRR46xaG9D0QqGcRzilN29B4-rE5nWW_qwRe_AX86one2s_C1wyqIVmm9qdGCEM6BnTAw
response_status_code	200

2021-07-01 15:28:12

(4) More

RESPONSE

CallTokenEndpoint

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "cache-control": "no-cache, no-store", "content-length": "833", "content-security-policy": "default-src \u0027self\u0027;base-uri \u0027self\u0027;block-all-mixed-content;font-src \u0027self\u0027 https: data:;frame-ancestors \u0027self\u0027;img-src \u0027self\u0027 data:;object-src \u0027none\u0027;script-src \u0027self\u0027;script-src-attr \u0027none\u0027;style-src \u0027self\u0027 https: \u0027unsafe-inline\u0027;upgrade-insecure-requests", "content-type": "application/json; charset\u003dutf-8", "date": "Thu, 01 Jul 2021 15:28:12 GMT", "expect-ct": "max-age\u003d0", "pragma": "no-cache", "referrer-policy": "no-referrer", "server": [ "Caddy", "Cowboy" ], "strict-transport-security": "max-age\u003d15552000; includeSubDomains", "vary": "Origin", "via": "1.1 vegur", "x-content-type-options": "nosniff", "x-dns-prefetch-control": "off", "x-download-options": "noopen", "x-frame-options": "SAMEORIGIN", "x-permitted-cross-domain-policies": "none", "x-xss-protection": "0" }
response_body	{"access_token":"-YHA4AusKW_TuuCnMbOzGU_VKbmAtJtaOXcmFD9Aj82","expires_in":3600,"id_token":"eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJzdWIiOiJmb28iLCJhY3IiOiJ1cm46bWFjZTppbmNvbW1vbjppYXA6c2lsdmVyIiwibm9uY2UiOiJFWGZSUUVMVnVWIiwiYXRfaGFzaCI6IkdoZWRhbXZFUmVfSU9TRXdIclc4WGciLCJhdWQiOiJtdGxzLW9uZSIsImV4cCI6MTYyNTE1Njg5MiwiaWF0IjoxNjI1MTUzMjkyLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.p_O7w3s2SKEPjrk7MY8H6Au2dh6fF-b-4jzmCdYhqWyaTRsGYyOq7fHdYHsTx6Ux9NfF4T685gajafZzyQ25_zAXoB9JxDCPj6-s8zxuEanpvs0JIJoem1clm2mW7K3FWb3qy73fJ5TgNJQsLncspjx_BfLSMdJlxg-T2sZoAy2q2JlNs3S_XLxsOnWHnK4dGvYvScB4RkAg5HGFw6eOmH2wd7vYIFbpTr6Yw0x9EbOzN9nA-5MkboB3WnYoFKnCyKAi8DS918NKFVd1k03DNRgfd5LyLLV2iILkCYdY_-4Pi_atdASSXjoEqWpO-kFzjyWHl1p27dBbHFWeEGxsIA","scope":"openid","token_type":"Bearer"}

2021-07-01 15:28:12

(1) More

CallTokenEndpoint

Token endpoint response

token_endpoint_response

{"access_token":"-YHA4AusKW_TuuCnMbOzGU_VKbmAtJtaOXcmFD9Aj82","expires_in":3600,"id_token":"eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJzdWIiOiJmb28iLCJhY3IiOiJ1cm46bWFjZTppbmNvbW1vbjppYXA6c2lsdmVyIiwibm9uY2UiOiJFWGZSUUVMVnVWIiwiYXRfaGFzaCI6IkdoZWRhbXZFUmVfSU9TRXdIclc4WGciLCJhdWQiOiJtdGxzLW9uZSIsImV4cCI6MTYyNTE1Njg5MiwiaWF0IjoxNjI1MTUzMjkyLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.p_O7w3s2SKEPjrk7MY8H6Au2dh6fF-b-4jzmCdYhqWyaTRsGYyOq7fHdYHsTx6Ux9NfF4T685gajafZzyQ25_zAXoB9JxDCPj6-s8zxuEanpvs0JIJoem1clm2mW7K3FWb3qy73fJ5TgNJQsLncspjx_BfLSMdJlxg-T2sZoAy2q2JlNs3S_XLxsOnWHnK4dGvYvScB4RkAg5HGFw6eOmH2wd7vYIFbpTr6Yw0x9EbOzN9nA-5MkboB3WnYoFKnCyKAi8DS918NKFVd1k03DNRgfd5LyLLV2iILkCYdY_-4Pi_atdASSXjoEqWpO-kFzjyWHl1p27dBbHFWeEGxsIA","scope":"openid","token_type":"Bearer"}

2021-07-01 15:28:12

(5) More

SUCCESS

CallTokenEndpoint

Parsed token endpoint response

access_token	-YHA4AusKW_TuuCnMbOzGU_VKbmAtJtaOXcmFD9Aj82
expires_in	3600
id_token	eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJzdWIiOiJmb28iLCJhY3IiOiJ1cm46bWFjZTppbmNvbW1vbjppYXA6c2lsdmVyIiwibm9uY2UiOiJFWGZSUUVMVnVWIiwiYXRfaGFzaCI6IkdoZWRhbXZFUmVfSU9TRXdIclc4WGciLCJhdWQiOiJtdGxzLW9uZSIsImV4cCI6MTYyNTE1Njg5MiwiaWF0IjoxNjI1MTUzMjkyLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.p_O7w3s2SKEPjrk7MY8H6Au2dh6fF-b-4jzmCdYhqWyaTRsGYyOq7fHdYHsTx6Ux9NfF4T685gajafZzyQ25_zAXoB9JxDCPj6-s8zxuEanpvs0JIJoem1clm2mW7K3FWb3qy73fJ5TgNJQsLncspjx_BfLSMdJlxg-T2sZoAy2q2JlNs3S_XLxsOnWHnK4dGvYvScB4RkAg5HGFw6eOmH2wd7vYIFbpTr6Yw0x9EbOzN9nA-5MkboB3WnYoFKnCyKAi8DS918NKFVd1k03DNRgfd5LyLLV2iILkCYdY_-4Pi_atdASSXjoEqWpO-kFzjyWHl1p27dBbHFWeEGxsIA
scope	openid
token_type	Bearer

Verify token endpoint response

2021-07-01 15:28:12	SUCCESS	CheckIfTokenEndpointResponseError No error from token endpoint

2021-07-01 15:28:12

(1) More

SUCCESS

FAPI1-BASE-5.2.2-14

CheckForAccessTokenValue

Found an access token

access_token

-YHA4AusKW_TuuCnMbOzGU_VKbmAtJtaOXcmFD9Aj82

2021-07-01 15:28:12

(2) More

SUCCESS

ExtractAccessTokenFromTokenResponse

Extracted the access token

value	-YHA4AusKW_TuuCnMbOzGU_VKbmAtJtaOXcmFD9Aj82
type	Bearer

2021-07-01 15:28:12

(1) More

SUCCESS

RFC6749-5.1

ExtractExpiresInFromTokenEndpointResponse

Extracted 'expires_in'

expires_in

2021-07-01 15:28:12

(1) More

SUCCESS

RFC6749-5.1

ValidateExpiresIn

expires_in passed all validation checks

expires_in

2021-07-01 15:28:12	INFO	CheckForRefreshTokenValue Couldn't find refresh token

2021-07-01 15:28:12

(3) More

INFO

RFC6749-10.10

EnsureMinimumRefreshTokenLength

Skipped evaluation due to missing required element: token_endpoint_response refresh_token

path	refresh_token
mapped
object	token_endpoint_response

2021-07-01 15:28:12

(3) More

INFO

RFC6749-10.10

EnsureMinimumRefreshTokenEntropy

Skipped evaluation due to missing required element: token_endpoint_response refresh_token

path	refresh_token
mapped
object	token_endpoint_response

2021-07-01 15:28:12

(2) More

SUCCESS

FAPI1-BASE-5.2.2-16

EnsureMinimumAccessTokenLength

Access token is of sufficient length

actual	344
required	128

2021-07-01 15:28:12

(2) More

SUCCESS

FAPI1-BASE-5.2.2-16

EnsureMinimumAccessTokenEntropy

Calculated shannon entropy seems sufficient

actual	208.57449695002674
expected	96.0

2021-07-01 15:28:12

(3) More

SUCCESS

FAPI1-BASE-5.2.2.1-6 OIDCC-3.3.2.5

ExtractIdTokenFromTokenResponse

Found and parsed the id_token from token_endpoint_response

value	eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJzdWIiOiJmb28iLCJhY3IiOiJ1cm46bWFjZTppbmNvbW1vbjppYXA6c2lsdmVyIiwibm9uY2UiOiJFWGZSUUVMVnVWIiwiYXRfaGFzaCI6IkdoZWRhbXZFUmVfSU9TRXdIclc4WGciLCJhdWQiOiJtdGxzLW9uZSIsImV4cCI6MTYyNTE1Njg5MiwiaWF0IjoxNjI1MTUzMjkyLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.p_O7w3s2SKEPjrk7MY8H6Au2dh6fF-b-4jzmCdYhqWyaTRsGYyOq7fHdYHsTx6Ux9NfF4T685gajafZzyQ25_zAXoB9JxDCPj6-s8zxuEanpvs0JIJoem1clm2mW7K3FWb3qy73fJ5TgNJQsLncspjx_BfLSMdJlxg-T2sZoAy2q2JlNs3S_XLxsOnWHnK4dGvYvScB4RkAg5HGFw6eOmH2wd7vYIFbpTr6Yw0x9EbOzN9nA-5MkboB3WnYoFKnCyKAi8DS918NKFVd1k03DNRgfd5LyLLV2iILkCYdY_-4Pi_atdASSXjoEqWpO-kFzjyWHl1p27dBbHFWeEGxsIA
header	{ "kid": "EUsMLFwXz5zMhkJoo1lcnIM2pApLc3kc_2WV8YKYC3M", "typ": "JWT", "alg": "PS256" }
claims	{ "at_hash": "GhedamvERe_IOSEwHrW8Xg", "sub": "foo", "acr": "urn:mace:incommon:iap:silver", "aud": "mtls-one", "iss": "https://fapi.panva.cz", "exp": 1625156892, "nonce": "EXfRQELVuV", "iat": 1625153292 }

2021-07-01 15:28:12	SUCCESS FAPI1-BASE-5.2.2.1-6	ValidateIdToken ID token iss, aud, exp, iat, auth_time, acr & nbf claims passed validation checks

2021-07-01 15:28:12

(1) More

SUCCESS

OIDCC-10.1

EnsureIdTokenContainsKid

kid was found in the ID token header

kid	EUsMLFwXz5zMhkJoo1lcnIM2pApLc3kc_2WV8YKYC3M

2021-07-01 15:28:12

(1) More

SUCCESS

OIDCC-2

ValidateIdTokenNonce

Nonce values match

nonce

EXfRQELVuV

2021-07-01 15:28:12

(2) More

SUCCESS

OIDCC-5.5.1.1

ValidateIdTokenACRClaimAgainstRequest

acr value in id_token is (one of) the requested values

actual	urn:mace:incommon:iap:silver
requested	[ "urn:mace:incommon:iap:silver" ]

2021-07-01 15:28:12

(1) More

SUCCESS

FAPI1-BASE-5.2.2.1-6

ValidateIdTokenSignature

id_token signature validated

id_token

eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJzdWIiOiJmb28iLCJhY3IiOiJ1cm46bWFjZTppbmNvbW1vbjppYXA6c2lsdmVyIiwibm9uY2UiOiJFWGZSUUVMVnVWIiwiYXRfaGFzaCI6IkdoZWRhbXZFUmVfSU9TRXdIclc4WGciLCJhdWQiOiJtdGxzLW9uZSIsImV4cCI6MTYyNTE1Njg5MiwiaWF0IjoxNjI1MTUzMjkyLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.p_O7w3s2SKEPjrk7MY8H6Au2dh6fF-b-4jzmCdYhqWyaTRsGYyOq7fHdYHsTx6Ux9NfF4T685gajafZzyQ25_zAXoB9JxDCPj6-s8zxuEanpvs0JIJoem1clm2mW7K3FWb3qy73fJ5TgNJQsLncspjx_BfLSMdJlxg-T2sZoAy2q2JlNs3S_XLxsOnWHnK4dGvYvScB4RkAg5HGFw6eOmH2wd7vYIFbpTr6Yw0x9EbOzN9nA-5MkboB3WnYoFKnCyKAi8DS918NKFVd1k03DNRgfd5LyLLV2iILkCYdY_-4Pi_atdASSXjoEqWpO-kFzjyWHl1p27dBbHFWeEGxsIA

2021-07-01 15:28:12

(1) More

SUCCESS

FAPI1-BASE-5.2.2.1-6

ValidateIdTokenSignatureUsingKid

id_token signature validated

id_token

eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVVc01MRndYejV6TWhrSm9vMWxjbklNMnBBcExjM2tjXzJXVjhZS1lDM00ifQ.eyJzdWIiOiJmb28iLCJhY3IiOiJ1cm46bWFjZTppbmNvbW1vbjppYXA6c2lsdmVyIiwibm9uY2UiOiJFWGZSUUVMVnVWIiwiYXRfaGFzaCI6IkdoZWRhbXZFUmVfSU9TRXdIclc4WGciLCJhdWQiOiJtdGxzLW9uZSIsImV4cCI6MTYyNTE1Njg5MiwiaWF0IjoxNjI1MTUzMjkyLCJpc3MiOiJodHRwczovL2ZhcGkucGFudmEuY3oifQ.p_O7w3s2SKEPjrk7MY8H6Au2dh6fF-b-4jzmCdYhqWyaTRsGYyOq7fHdYHsTx6Ux9NfF4T685gajafZzyQ25_zAXoB9JxDCPj6-s8zxuEanpvs0JIJoem1clm2mW7K3FWb3qy73fJ5TgNJQsLncspjx_BfLSMdJlxg-T2sZoAy2q2JlNs3S_XLxsOnWHnK4dGvYvScB4RkAg5HGFw6eOmH2wd7vYIFbpTr6Yw0x9EbOzN9nA-5MkboB3WnYoFKnCyKAi8DS918NKFVd1k03DNRgfd5LyLLV2iILkCYdY_-4Pi_atdASSXjoEqWpO-kFzjyWHl1p27dBbHFWeEGxsIA

2021-07-01 15:28:12

(1) More

SUCCESS

FAPI1-BASE-5.2.2.1-6 OB-5.2.2-8

CheckForSubjectInIdToken

Found 'sub' in id_token

sub

foo

2021-07-01 15:28:12

(2) More

SUCCESS

FAPI1-ADV-8.6

FAPIValidateIdTokenSigningAlg

id_token was signed with a permitted algorithm

permitted	[ "ES256", "PS256" ]
alg	PS256

2021-07-01 15:28:12

(3) More

INFO

FAPI1-ADV-8.6.1-1

FAPIValidateIdTokenEncryptionAlg

Skipped evaluation due to missing required element: id_token jwe_header

path	jwe_header
mapped
object	id_token

2021-07-01 15:28:12

(3) More

INFO

OIDCC-10.1

FAPIValidateEncryptedIdTokenHasKid

Skipped evaluation due to missing required element: id_token jwe_header

path	jwe_header
mapped
object	id_token

2021-07-01 15:28:12	INFO OIDCC-3.3.2.11	ExtractCHash Couldn't find c_hash in ID token

2021-07-01 15:28:12	INFO FAPI1-ADV-5.2.2.1-5	ExtractSHash Couldn't find s_hash in ID token

2021-07-01 15:28:12

(2) More

SUCCESS

OIDCC-3.3.2.11

ExtractAtHash

Extracted at_hash from ID Token

at_hash	GhedamvERe_IOSEwHrW8Xg
alg	PS256

2021-07-01 15:28:12

(2) More

INFO

OIDCC-3.3.2.11

ValidateCHash

Skipped evaluation due to missing required object: c_hash

expected	c_hash
mapped

2021-07-01 15:28:12

(2) More

INFO

FAPI1-ADV-5.2.2.1-5

ValidateSHash

Skipped evaluation due to missing required object: s_hash

expected	s_hash
mapped

2021-07-01 15:28:12

(3) More

SUCCESS

OIDCC-3.3.2.11

ValidateAtHash

at_hash validated successfully

expected_hash	GhedamvERe_IOSEwHrW8Xg
unhashed_value	-YHA4AusKW_TuuCnMbOzGU_VKbmAtJtaOXcmFD9Aj82
id_token_hash	GhedamvERe_IOSEwHrW8Xg

Resource server endpoint tests

2021-07-01 15:28:12

(1) More

CreateEmptyResourceEndpointRequestHeaders

Created empty headers

resource_endpoint_request_headers

{}

2021-07-01 15:28:12

(1) More

SUCCESS

FAPI1-BASE-6.2.2-3

AddFAPIAuthDateToResourceEndpointRequest

Added x-fapi-auth-date to resource endpoint request headers

resource_endpoint_request_headers

{
  "x-fapi-auth-date": "Thu, 01 Jul 2021 15:28:12 GMT"
}

2021-07-01 15:28:12

(1) More

AddIpV4FapiCustomerIpAddressToResourceEndpointRequest

Added x-fapi-customer-ip-address containing IPv4 address to resource endpoint request headers

resource_endpoint_request_headers

{
  "x-fapi-auth-date": "Thu, 01 Jul 2021 15:28:12 GMT",
  "x-fapi-customer-ip-address": "198.51.100.119"
}

2021-07-01 15:28:12

(1) More

CreateRandomFAPIInteractionId

Created interaction ID

fapi_interaction_id

fef78435-7556-4fba-abc9-0895f71e4393

2021-07-01 15:28:12

(1) More

SUCCESS

FAPI1-BASE-6.2.2-5

AddFAPIInteractionIdToResourceEndpointRequest

Added x-fapi-interaction-id to resource endpoint request headers

resource_endpoint_request_headers

{
  "x-fapi-auth-date": "Thu, 01 Jul 2021 15:28:12 GMT",
  "x-fapi-customer-ip-address": "198.51.100.119",
  "x-fapi-interaction-id": "fef78435-7556-4fba-abc9-0895f71e4393"
}

2021-07-01 15:28:12

(5) More

CallProtectedResourceWithBearerTokenAndCustomHeaders

HTTP request

request_uri	https://mtls.fapi.panva.cz/accounts
request_method	GET
request_headers	{ "accept": "application/json;charset\u003dUTF-8", "x-fapi-auth-date": "Thu, 01 Jul 2021 15:28:12 GMT", "x-fapi-customer-ip-address": "198.51.100.119", "x-fapi-interaction-id": "fef78435-7556-4fba-abc9-0895f71e4393", "authorization": "Bearer -YHA4AusKW_TuuCnMbOzGU_VKbmAtJtaOXcmFD9Aj82", "accept-charset": "utf-8", "content-length": "0" }
request_body
request_mutual_tls	{ "cert": "MIIC4DCCAcgCCQDuBF1vmG5mlDANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwHhcNMTkwNjE4MTIzMTA2WhcNMjAwNjE3MTIzMTA2WjAyMQswCQYDVQQGEwJDWjEPMA0GA1UEBwwGUHJhZ3VlMRIwEAYDVQQDDAlwa210bHNvbmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFGKYDieCWZ63Fx9jMhtlPlHUgkR6bmKqGwvZuVAe9Zz+sHvbVtTk/4AEOjSozksxf070O1PnK3zY0SuZynhKJnTaFouN45iMnnNQS6XMKd9Tm5WpSRbxfaOeuIZybvOmNy0nuxkvqcE5fXIyr9bDCO9WEArQIQqjGJ93zKJpV2nT9Q7heTK430z7Hp3+XxwGXoKsLW/jebr3ryWTMEv8ouEbXeCz2OH6Oup8UIwXDyjYxwhwS5FAcRQdh4KnhHOLGYVAuVR3wPewtrTioYznFdfwtDHGd9fZVxrXPlVqCksj0CTnPf7UgXtjm2hTfkwHHtW2BegWR/q3+q9gs7uehc\u003d", "key": "MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDEEnW885Hp+2Q7l+KCtKPOwfPIVOLKshgygWIAXC8z5TKnA1N9qbB2BvpDpWUKdXrYuBzWcNH/PHwrJvX42AHGeXCZJDSXzuRH934/fjMQHTFJquoP4rziUlRJfT+pwJcuvgxgGLI5xgzNqD7gZZp/9LVm5OdXU1poQviUel+hwV5eiT1r1fOe5LOiXkLwp3kBLlqGrtRPFIIa+20qkvnFh5ZcnRmOmm2vcAnI7OaNc2rSLHVbvkFuY8mMEx8rtthq0dQyyy1Ucudi3cLCI2x8Px0qQFUqWH4LgNaj7VZjlU1NPE8LjsSPLasZsMsn0wt22fo+v5bJbaZ3N3QQqM0VAgMBAAECggEBAKrgF6Hrd9+9yhWxgaM9gIDhQO73I4tY+IOThHAh5rVIawNof6vFZdcGr7aiftNFnSEgG2m7exgAg4or8zPCNJHfJgUgq4Eduo8JnwoAlsnVVy4HeOMNTGXFMFW3hPMQt/DxieF5xGFbO69DkECJ68LV5f3dQcw2BVVWAEON/qf9UhgEnx79OdiCYzyoHjxaHoXk9cVTUtXwmU0lphRFT14W2Py0KZ5vA8JEefoZl/qEo42iR0KB4eDj/LiduWAMKDLN/u0Dmq3WxLvw7LHnlqENTEY56Lw1sbMQlmvl0zCD68BeMz+Mvlm7VRSCxR+3uX6Nli3eb2EsYziZIlt00iUCgYEA4ZNvp0u6vXQAf7IGESuhu3u4cD6K8iJ6BT+O64yHJzc17e9lt+p89GasTtkgeEH/lr+XxScVBYndi/8vaqsA47bkIoWVvcXq7C4jkv0bPelpaI/KPGfoZC1etR102+dS1ZufxzwSo64drw+HPuwaIkXvmpK4MBI9jEYoOHh9KR8CgYEA3oRU/iCWvKOGHlR9BmcBysVGmkvBwj8XLTJGfxJkm3M9utLSg0uNo7vW0Zm88KdzdeaRBt6ltZAG3hBL0mHNwC0hYRv5fzO7yczWFLPXbUNVqC5OLI+wTL7+ikx040lL9IRRtgub47+9IvxxaGaIRzsFwa+15D7TCE7K8BydH0sCgYEAivnkC2VL2tcyS3op5MBF95Vk77qIrl9xX/RloFfHGPEaB8q7l5EfhRAQzs9VAuJejsjhv7SxbeUfmtYQp55NgP44FdDJjc73SqWugyvvcbhxmdslFQxLkBSnydwpGCav0Sz9RqmLLk7iuO1PPQQHoeAGm+wTEILcaqT6uLf7HK8CgYBOlloWLphOI0q454oIetTNMoNO9zaFThb3ZWw0cOCLblX853xl1oc9rpeeCzgJnnpOx5Gs5XGNAEMMpqDAur4aA1Zon6KsZC8MhIWPZjzNYByee0wsvMq9MC9h1MLrivWCdEEPlGYIN62q75F2F9BFp/jOgSoyZGXP51QRHWn4pQKBgCEy7GsS3sAj3GiTmCkVvR3gKSlSKmJULmI+8EoT6tzYhMvyqoCHPtll2DHzBeqA6Il2DKz+gFbKln2+LrPUrb2rgK9e8qdZH9X36Ws8u9YA/VasGQRUFIAcFcNWoBBX79nBQ/89zrPubaN2Rh9BKuUEGLKAzDf1JIzseUr8jdvw" }

2021-07-01 15:28:13

(4) More

RESPONSE

CallProtectedResourceWithBearerTokenAndCustomHeaders

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "cache-control": "no-cache, no-store", "content-length": "13", "content-security-policy": "default-src \u0027self\u0027;base-uri \u0027self\u0027;block-all-mixed-content;font-src \u0027self\u0027 https: data:;frame-ancestors \u0027self\u0027;img-src \u0027self\u0027 data:;object-src \u0027none\u0027;script-src \u0027self\u0027;script-src-attr \u0027none\u0027;style-src \u0027self\u0027 https: \u0027unsafe-inline\u0027;upgrade-insecure-requests", "content-type": "application/json; charset\u003dutf-8", "date": "Thu, 01 Jul 2021 15:28:13 GMT", "expect-ct": "max-age\u003d0", "pragma": "no-cache", "referrer-policy": "no-referrer", "server": [ "Caddy", "Cowboy" ], "strict-transport-security": "max-age\u003d15552000; includeSubDomains", "vary": "Origin", "via": "1.1 vegur", "x-content-type-options": "nosniff", "x-dns-prefetch-control": "off", "x-download-options": "noopen", "x-fapi-interaction-id": "fef78435-7556-4fba-abc9-0895f71e4393", "x-frame-options": "SAMEORIGIN", "x-permitted-cross-domain-policies": "none", "x-xss-protection": "0" }
response_body	{"sub":"foo"}

2021-07-01 15:28:13

(3) More

SUCCESS

FAPI1-BASE-6.2.1-1 FAPI1-BASE-6.2.1-3

CallProtectedResourceWithBearerTokenAndCustomHeaders

Got a response from the resource endpoint

headers

{
  "cache-control": "no-cache, no-store",
  "content-length": "13",
  "content-security-policy": "default-src \u0027self\u0027;base-uri \u0027self\u0027;block-all-mixed-content;font-src \u0027self\u0027 https: data:;frame-ancestors \u0027self\u0027;img-src \u0027self\u0027 data:;object-src \u0027none\u0027;script-src \u0027self\u0027;script-src-attr \u0027none\u0027;style-src \u0027self\u0027 https: \u0027unsafe-inline\u0027;upgrade-insecure-requests",
  "content-type": "application/json; charset\u003dutf-8",
  "date": "Thu, 01 Jul 2021 15:28:13 GMT",
  "expect-ct": "max-age\u003d0",
  "pragma": "no-cache",
  "referrer-policy": "no-referrer",
  "server": [
    "Caddy",
    "Cowboy"
  ],
  "strict-transport-security": "max-age\u003d15552000; includeSubDomains",
  "vary": "Origin",
  "via": "1.1 vegur",
  "x-content-type-options": "nosniff",
  "x-dns-prefetch-control": "off",
  "x-download-options": "noopen",
  "x-fapi-interaction-id": "fef78435-7556-4fba-abc9-0895f71e4393",
  "x-frame-options": "SAMEORIGIN",
  "x-permitted-cross-domain-policies": "none",
  "x-xss-protection": "0"
}

status_code

{
  "code": 200
}

body

{"sub":"foo"}

2021-07-01 15:28:13

(2) More

SUCCESS

FAPI1-BASE-6.2.1-11

CheckForDateHeaderInResourceResponse

Date header present and validated

date	Thu, 01 Jul 2021 15:28:13 GMT
skew	651

2021-07-01 15:28:13

(1) More

SUCCESS

FAPI1-BASE-6.2.1-11

CheckForFAPIInteractionIdInResourceResponse

Found x-fapi-interaction-id

interaction_id

fef78435-7556-4fba-abc9-0895f71e4393

2021-07-01 15:28:13

(1) More

SUCCESS

FAPI1-BASE-6.2.1-11

EnsureMatchingFAPIInteractionId

Interaction ID matched

fapi_interaction_id

fef78435-7556-4fba-abc9-0895f71e4393

2021-07-01 15:28:13

(1) More

SUCCESS

FAPI1-BASE-6.2.1-9 FAPI1-BASE-6.2.1-10

EnsureResourceResponseReturnedJsonContentType

Response content type is JSON

content_type

application/json; charset=utf-8

2021-07-01 15:28:13

(1) More

FINISHED

fapi1-advanced-final-ensure-request-object-with-multiple-aud-succeeds

Test has run to completion

testmodule_result

PASSED

2021-07-01 15:28:16

(2) More

TEST-RUNNER

Alias has now been claimed by another test

alias	oidc-provider-by_value-mtls-plain_fapi-jarm
new_test_id	sudjx4rP7DzGQUm

Test Summary

Test Results