Conformance Testing for OpenID for Verifiable Credential Issuance

For Issuers and Wallets

This document details the procedures for executing OpenID for Verifiable Credential Issuance 1.0 (OpenID4VCI) conformance tests and compiling the resulting data for certification.

Jump to

The conformance suite is designed to support the testing of OpenID for Verifiable Credential Issuance Wallet and Issuer implementations that comply with the HAIP profile.

Do not hesitate to register issues in the conformance suite project if you observe unexpected or incorrect behavior or have questions regarding the tests.

Supported Specifications

The OpenID Foundation certification checks conformance for the following specifications:

 

Note: When selecting a test plan, always choose the plans with the “/HAIP” suffix (e.g
“OpenID for Verifiable Credential Issuance 1.0 Final/HAIP: …”). The plans without the suffix omit the HAIP-specific requirements and are not intended for certification testing.

Whilst the tests can be run with either mdoc or SD-JWT VC credentials, implementers should note that these credential formats are not exhaustively tested and an OpenID Certification with mdoc or SD-JWT VC only means that the mdoc or SD-JWT VC provisions contained within OID4VP and HAIP are correctly implemented. The implementer must test other requirements from the mdoc or SD-JWT VC specifications, along with any credential specific requirements, themselves.

Testing an Issuer

The conformance suite employs an emulated OpenID4VCI wallet to evaluate the behavior of the OpenID4VCI issuer.

Currently, the suite supports the HAIP profile for testing an OpenID4VCI issuer using either the SD JWT VC or MDOC credential formats. The test can be configured to utilize both the wallet-initiated and issuer-initiated authorization code flow variations. Note that this test does not support the pre-authorized code flow, as HAIP mandates the use of the authorization code flow.

For HAIP, client attestation is required as the client authentication mechanism.

The test suite will request a credential based on the configured credential configuration ID and a scope, found within the respective credential configuration metadata.

Please note that you need to run the tests for each credential format you want to certify.

Setup Steps for Issuers

  • Register a client in your authorization server that represents the emulated wallet used by the conformance test suite and the necessary keys/certificates. 
  • The redirect URL for the client must be: https://www.certification.openid.net/test/a/ALIAS/callback
    • ALIAS must be replaced with a string that is unique to you/your organization, to avoid other conformance suite users affecting your testing.
  • The IP address the conformance suite will use to make outgoing calls is 35.196.44.185, which is also available on the test suite home page after login.

Instructions for Running Tests for Issuers

  1. Testplan Setup
    1. Open https://www.certification.openid.net/
    2. Sign in using a Google or GitLab account
      (Any Google or GitLab account can be used; the login process is purely to protect access to the test data; the system is open for anyone to use)
    3. Click “Create a new test plan”.
  2. Test Plan Selection
    1. Select Specification: OID4VCI
    2. Select Entity Under Test: Test a OpenID4VCI Issuer
    3. Select test plan:
      OpenID for Verifiable Credential Issuance 1.0 Final/HAIP: Test an Issuer.
    4. Select “Credential Format”: sd_jwt_vc or mdoc
    5. Select “Authorization Code Flow Variant”: wallet_initiated or issuer_initiated.
  3. Test Information
    1. Specify an “alias” that is unique to you/your organization.
    2. Specify a meaningful “description”.
    3. Choose whether to “publish” the test results
      (No, Summary, or Everything).
  4. Credential Issuer Settings
    1. Configure the “Credential Issuer URL”
      (The openid-credential-issuer metadata URI will be derived from it).
    2. Specify the “Credential Trust Anchor”
      (The trust anchor certificate for verifying the credentials x5c chain, in PEM format).
    3. Specify the “Status List Trust Anchor”
      (The trust anchor certificate for verifying the status list token x5c chain, in PEM format).
    4. Specify the “credential configuration id” of the credential you want to use.
  5. Client Settings 1
    1. Specify the client ID to use for Client 1.
  6. Client Settings 2
    1. Specify the client ID to use for Client 2.
  7. Client Attestation Settings
    1. Specify the Client Attestation Issuer.
      (URI used as the client attestation issuer)
    2. Specify the Client Attester Keys JWKS (private key + public key + x5c).
      (Pre-configured keys of the client attester in JWKS format. Note the Client Attester Certificate must be provided in the x5c JWK claim as a JSON array with the encoded certificate)
  8. Key Attestation Settings
    1. Specify the Key Attestation JWKS (private key + public key + x5c).
      (Pre-configured keys of the key attestation JWKS format. Leave empty if Key attestation is not used. Note the Client Attester Certificate must be provided in the x5c JWK claim as a JSON array with the encoded certificate.)

 

After the test plan is configured, click on “Click Create testplan”. On the next screen, you see a list of test modules associated with the test plan.

To execute a test plan, click the “Run Test” button of the individual test modules.

Once all tests are executed, you can submit the conformance test results.

For this, see “Submitting the Conformance Test Results” below.

Testing a Wallet

The conformance suite uses an emulated OpenID4VCI Issuer to test wallet behavior.

We currently support the HAIP profile for testing an OpenID4VCI wallet with SD JWT VC or MDOC credential formats.

We support the wallet-initiated and issuer-initiated authorization code flow variants.

For HAIP, client attestation is used as the client authentication mechanism.

Credential Configurations

The emulated OpenID4VCI Issuer supports the following credential configurations:

  • eu.europa.ec.eudi.pid.1
    • Scope: eudi.pid.1
    • Format: dc+sd-jwt
  • eu.europa.ec.eudi.pid.1.attestation
    • Scope: eudi.pid.1.attestation
    • Format: dc+sd-jwt
  • eu.europa.ec.eudi.pid.1.jwt.keyattest
    • Scope: eudi.pid.1.jwt.keyattest
    • Format: dc+sd-jwt
  • eu.europa.ec.eudi.pid.1.attestation.keyattest
    • Scope: eudi.pid.1.attestation.keyattest
    • Format: dc+sd-jwt
  • eu.europa.ec.eudi.pid.1.jwt_and_attestation.keyattest
    • Scope: eudi.pid.1.jwt_and_attestation.keyattest
    • Format: dc+sd-jwt
  • eu.europa.ec.eudi.pid.1.nobinding
    • Scope: eudi.pid.1.nobinding
    • Format: dc+sd-jwt
  • eu.europa.ec.eudi.pid.mdoc.1
    • Scope: eudi.pid.mdoc.1
    • Format: mso_mdoc
  • eu.europa.ec.eudi.pid.mdoc.1.attestation
    • Scope: eudi.pid.mdoc.1.attestation
    • Format: mso_mdoc
  • eu.europa.ec.eudi.pid.mdoc.1.jwt.keyattest
    • Scope: eudi.pid.mdoc.1.jwt.keyattest
    • Format: mso_mdoc
  • eu.europa.ec.eudi.pid.mdoc.1.attestation.keyattest
    • Scope: eudi.pid.mdoc.1.attestation.keyattest
    • Format: mso_mdoc
  • org.iso.18013.5.1.mDL
    • Scope: org.iso.18013.5.1.mDL
    • Format: mso_mdoc
  • org.iso.18013.5.1.mDL.attestation
    • Scope: org.iso.18013.5.1.mDL.attestation
    • Format: mso_mdoc

Please use the openid-credential-issuer metadata to learn more about the credential configurations:

https://www.certification.openid.net/.well-known/openid-credential-issuer/test/a/ALIAS/

The openid-credential-issuer metadata endpoint will be available after the wallet test has started.

Testing mdoc support

If your OpenID4VCI wallet supports mdoc and you’re not sure which credential to use, use an org.iso.18013.5.1.mDL as credential configuration ID.

Testing SD JWT VC support

If your OpenID4VCI wallet supports SD JWT VC and you’re not sure which credential to use, use eu.europa.ec.eudi.pid.1 as the credential configuration ID.

Setup Steps for Wallets

  • Gather the necessary keys/certificates for the wallet.
  • Use the following credential issuer https://www.certification.openid.net/test/a/ALIAS/
  • ALIAS must be replaced with a string that is unique to you/your organization, to avoid other conformance suite users affecting your testing.
  • As stated above, the IP address the conformance suite will use to make outgoing calls is 35.196.44.185, which is also available on the test suite home page after login.

Please note that you need to run the tests for each credential format you want to certify.

Instructions for Running Tests for Wallets

  1. Testplan Setup
    1. Open https://www.certification.openid.net/
    2. Sign in using a Google or GitLab account
      (Any Google or GitLab account can be used; the login process is purely to protect access to the test data; the system is open for anyone to use)
    3. Click “Create a new test plan”.
  2. Test Plan Selection
    1. Select Specification: OID4VCI
    2. Select Entity Under Test: Test a OpenID4VCI Wallet
    3. Select test plan:
      OpenID for Verifiable Credential Issuance 1.0 Final/HAIP: Test a Wallet.
    4. Select “Authorization Code Flow Variant”: wallet_initiated or issuer_initiated.
    5. Select “Credential Format”: sd_jwt_vc or mdoc
    6. Select “Credential Offer Variant”: by_value or by_reference
      (this is only shown when issuer_initiated is used)
  3. Test Information
    1. Specify an “alias” that is unique to you/your organization.
    2. Specify a meaningful “description”.
    3. Choose whether to “publish” the test results
      (No, Summary, or Everything).
  4. Credential Issuer Settings
    1. Configure the “Signing JWK” (private key + public key + x5c)
      (Signing key to be used for issuing credentials, in JWK format. Note that the JWK must also contain the signing certificate chain in the x5c claim.)
    2. Specify the “Credential Configuration ID” of the credential configuration you want to use if the issuer-initiated flow is used.
      (You can use any credential from the list above. When left empty, “eu.europa.ec.eudi.pid.1” is used by default.)
    3. Specify the “Credential Offer Endpoint URL”
      (e.g. haip-vci://, if the issuer-initiated flow is used.)
  5. Server Settings
    1. Specify the “JWKS” for Server Keys (private key + public key + x5c)
      (Private key to be used by the server to sign id_tokens, this should be one key in JSON Web Key Set format.)
  6. Client Settings
    1. Specify the “client_id” to use for Client 1.
  7. Client Attestation Settings
    1. Specify the Client Attestation Issuer.
      (URI used as the client attestation issuer)
    2. Specify the Client Attestation Trust Anchor.
      (The trust anchor of the Client Attestation as PEM certificate)
  8. Key Attestation Settings
    1. Specify the Key Attestation Trust Anchor.
      (The trust anchor of the Key Attestation as PEM certificate.)

After the test plan is configured, click on “Click Create testplan”. On the next screen, you see a list of test modules associated with the test plan.

To execute a test plan, click the “Run Test” button of the individual test modules.

Once all tests are executed, you can submit the conformance test results.

For this, see “Submitting the Conformance Test Results” below.

Submitting the Conformance Test Results

This guide describes how to submit your certification request.

https://openid.net/how-to-submit-your-certification-request/

Getting Help

If you would like any help, please email certification@oidf.org. If it relates to a test failure, please include a link to the relevant log-detail.html, or, if using a local install, the downloaded log file.

If you think you have found a bug, please report it in GitLab

https://gitlab.com/openid/conformance-suite/-/issues/new.