This page describes how to submit completed OP conformance testing results to the OpenID Foundation to request OpenID Certifications. Before submission, first all tests must be successfully passed for the desired conformance profiles and testing results gathered, as described in the OP testing instructions. Note that results with warnings are acceptable for certification purposes.
While the Basic OP profile requires only one set of test runs (for the
code response type), the Implicit OP profile requires two (for the
id_token+token response types), and the Hybrid OP profile requires three (for the
code+id_token+token response types). The Config OP and Dynamic OP profiles require only one set of test runs each, which can be performed using any response type. The Form Post OP profile requires you to submit test runs for all the response_type values supported by your implementation.
For each conformance profile being certified to, the following information must be submitted in its own certification package:
- A signed copy of the Certification of Conformance (docx) (PDF) naming that profile. This should use the filename
OpenID-Certification-of-Conformance.pdfin the submitted results. (A different extension such as .jpg for the scanned document may be used as appropriate.)
- A copy of the Certification Terms and Conditions document accompanying the Certification of Conformance. This must use the filename
OpenID-Certification-Terms-and-Conditions.pdfin the submitted results. (This document is not signed but is included for completeness since it is referenced from the Certification of Conformance.)
- Test log files for each test in the profile (HTML or text) for each response_type value required for the profile. Each log file should either be retrieved from your test page https://op.certification.openid.net:your_port and saved with the filename profile-name/test-ID.html or from https://op.certification.openid.net:your_port;/log and use profile-name/test-ID.html as the filename. For instance, the filename
code.config.static.sign/OP-Response-code.htmlshould be used for the OP-Response-code test log when run with the configuration response_type=code, support for .well-known/openid-configuration, static registration, and support for signing when downloaded from the test page or use the name
code.config.static.sign/OP-Response-code.txtwhen downloaded from the /log page.
- Screen captures for each test requiring them (image files) for each response_type value required for the profile. For instance, the filename
code.config.static.sign/OP-redirect_uri-NotReg.pngshould be used for the screen shot of the error shown by the OP when a request uses an unregistered redirect_uri value. (A different extension such as .jpg for the screen shot may be used as appropriate.)
- For the Dynamic OP profile only, a signed Attestation Statement (docx) (PDF) declaring that the implementation correctly implements behaviors required for the profile that are not testable or were not tested by the tool. This should use the filename
OpenID-Certification-Attestation-Statement.pdfin the submitted results. (A different extension such as .jpg for the scanned document may be used as appropriate.).
The certification package should consist of a single .zip or .tar file containing all the files and using the paths above. The filename should contain the name of the organization, the software being certified, the profile being certified to, and the current date. For example, a certification request by the ProseWare organization of its “Humongous Identity” software for the Basic OP profile on April 13, 2015 should use a filename like
- Name of Entity (“Implementer”) Making this Certification: ProseWare
- Software or Service (“Deployment”) Name & Version #: Humongous Identity 3.14159
- OpenID Connect Conformance Profile: Basic OpenID Provider
- Conformance Test Suite Software & Version #: op.certification.openid.net 2.0.5
- Test Date: April 10, 2015
- Authorized Signature: HQB
- Name: Harry Q. Bovik
- Title: Senior Computer Scientist
- Date: April 13, 2015
- Implementer’s Name: Jane Doe
- Implementer’s Title: Programmer Extraordinaire
- Implementer’s Phone: +1 (412) 555-1234
- Implementer’s Email: email@example.com
- Implementer’s Address: 5000 Forbes Ave.
- Implementer’s City, State/Province, Postal Code: Pittsburgh, PA 15213
- Implementer’s Country: United States of America
The conformance test suite software version number can be found at the bottom right of the testing Web pages and at the top of the log files.
Contents for several certification submission examples can be viewed at Certification Submission Examples. These examples show the expected contents of the .zip or .tar files for certification submissions for each conformance profile.
The certification package must be sent to the OpenID Foundation as an attachment at firstname.lastname@example.org. The subject line of the e-mail request should be along the lines of “Certification request by ProseWare of Humongous Identity for the Basic OP profile”. If receipt of the submission is not acknowledged within two days (or three days if over a weekend), feel free to inquire about whether it was received by e-mailing a message without the attachment (to keep the size of the inquiry small) to email@example.com, cc’ing firstname.lastname@example.org.
A fee is required for certifications unless the conformance profile is still in the pilot phase. Currently the Third Party-Initiated Login OP profile is in the pilot phase. See the OpenID Certification Fee Schedule page for more information. Please pay for your certification application at the Certification Payment page when you make your submission.
Third Party-Initiated Login OP Profile
Third Party-Initiated Login OP tests are currently available in the pilot phase. Please submit your results for this profile as a separate .zip or .tar file in the normal manner. These tests are:
Logout OP Profiles
NEW! Testing for OP logout profiles is currently in the pilot phase. Please submit your results for these profiles as separate .zip or .tar files in the normal manner.