How to Run Conformance Tests for OpenID for Verifiable Presentations

 For Wallets and Verifiers

OpenID Foundation is has checking that wallets and verifiers correctly & securely implement the OpenID for Verifiable Presentation specification. (Tests for OpenID for Verifiable Credential Issuance are also available).
 
Jump to:
The specifications tested are:
It is also possible to test older versions of OpenID4VP, including the ID2 version used in ISO 18013-7 Annex B.
 
Certifications are only accepted for OpenID4VP 1.0 Final and support for HAIP 1.0 Final is mandatory for certification.

Whilst the tests can be run with either mdoc or SD-JWT VC credentials, implementers should note that these credential formats are not exhaustively tested and an OpenID Certification with mdoc or SD-JWT VC only means that the mdoc or SD-JWT VC provisions contained within OID4VP and HAIP are correctly implemented. The implementer must test other requirements from the mdoc or SD-JWT VC specifications, along with any credential specific requirements, themselves.

Testing a Wallet

Access the conformance suite here
 
 
If you follow the above link and login with any google/gitlab account then it will pre-fill the form with example values. If testing SD-JWT VC or the W3C Browser API, change the relevant selections.
 
If the wallet will accept a self signed certificate for the x509_hash client authentication, the client jwks in the example configuration may be used as is. Other fields should be filled out. When filling in the configuration form the fields all have help values available by hovering your mouse pointer over the ‘i’ button.
 
You must select an “alias” to use. This will form part of any urls hosted by the conformance suite and should be unique to yourself, for example your company name. (If you use the same alias as another user, yours tests may interfere with each other.) 
 
Once you have created your test plan, you should run each test in the test plan. Please be sure to pay attention to the details/instructions in the blue box at the top of each test.
 
Please contact the certification team if you’d like some help, need different specification features to be supported or if anything goes wrong (or to let us know it went well – we are actively encouraging feedback on these tests!):
 

 

Testing a Verifier

These tests are under active development – extra options and additional tests (e.g. negative tests checking that credentials with bad key binding are rejected) will be added soon.
 
It is recommended to run VC tests on the ‘demo’ server (rather than the production one) as this contains the latest changes. The following link will open this server and preconfigure some values:
 
 
Please ensure you change the values marked with FIXMEs and check other values (e.g. credential format) are correctly selected.
 
This link contains a JWK with an x5c entry containing a self-signed certificate that is used for signing credentials. You can use this as is, or replace it with a JWK of your own that your verifier will trust. The corresponding PEM certificate for that JWK is shown at the bottom of this page.
 
Once you have configured the tests, press ‘create test plan’ and then ‘Run Test’. The test will go into ‘WAITING’ status, indicating that it is waiting for the verifier to send the OpenID4VP request to the conformance suite’s ‘fake’ wallet.
 
When configuring your verifier, you must use the ‘authorization_endpoint’ url (shown in the ‘Exported Values’ section shown when you start running the test) instead of the ‘openid4vp://’ scheme you normally use to launch the wallet – in the same way a web-based wallet would be invoked. The ‘authorization_endpoint’ url value will be the same for all tests that use the same ‘alias’ value in the test configuration.
 
Alternatively, you can paste the ‘openid4vp://’ url from your verifier into the text box. If using Chrome, you can scan a QR code from your verifier using a camera.
 
-----BEGIN CERTIFICATE-----
MIICHjCCAcOgAwIBAgIUZX9BS5CDOJRW2t1FK1UDMt/QwMEwCgYIKoZIzj0EAwIw
ITELMAkGA1UEBhMCR0IxEjAQBgNVBAMMCU9JREYgVGVzdDAeFw0yNDExMjUwODM2
MDRaFw0zNDExMjMwODM2MDRaMCExCzAJBgNVBAYTAkdCMRIwEAYDVQQDDAlPSURG
IFRlc3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATT/dLsd51LLBrGV6R23o6v
ymRxHXeFBoI8yq31y5kFV2VV0gi9x5ZzEFiq8DMiAHucLACFndxLtZorCha9zznQ
o4HYMIHVMB0GA1UdDgQWBBS5cbdgAeMBi5wxpbpwISGhShAWETAfBgNVHSMEGDAW
gBS5cbdgAeMBi5wxpbpwISGhShAWETAPBgNVHRMBAf8EBTADAQH/MIGBBgNVHREE
ejB4ghB3d3cuaGVlbmFuLm1lLnVrgh1kZW1vLmNlcnRpZmljYXRpb24ub3Blbmlk
Lm5ldIIJbG9jYWxob3N0ghZsb2NhbGhvc3QuZW1vYml4LmNvLnVrgiJkZW1vLnBp
ZC1pc3N1ZXIuYnVuZGVzZHJ1Y2tlcmVpLmRlMAoGCCqGSM49BAMCA0kAMEYCIQCP
bnLxCI+WR1vhOW+A8KznAWv1MJo+YEb1MI45NKW/VQIhALzsqox8VuBRwN2dl5Lk
pnxP4oH9p6H0AOZmKP+Y7nXS
-----END CERTIFICATE----- 
 

 

Submitting the Conformance Test Results

This guide describes how to submit your certification request.

https://openid.net/how-to-submit-your-certification-request/

 

Getting Help

If you would like any help, please email certification@oidf.org. If it relates to a test failure, please include a link to the relevant log-detail.html, or, if using a local install, the downloaded log file.

If you think you have found a bug, please report it in GitLab

https://gitlab.com/openid/conformance-suite/-/issues/new.