OpenID Connect Provider Certification Test Result

The certification test suite is migrating to a new service here and will be decommissioned soon.

During the current transition period, you are encouraged to run both this suite and the new suite for new certifications and to provide feedback on the new suite. See here for details on the migration.

Test Info

Issuerhttps://cloud-api.loginradius.com/sso/oidc/v2/internal-mayank/oidctest
Profile[]
Test IDOP-claims-essential
Test descriptionClaims request with essential name claim
Timestamp2020-07-09T07:11:48Z

Conditions


verify-claims: status=OK [Verifies that the claims returned as UserInfo or in the ID Token is consistent with what was asked for]
check-http-response: status=OK [Checks that the HTTP response status is within the 200 or 300 range. Also does some extra JSON checks]
Done: status=OK

Trace Output

0phase<--<-- 0 --- Webfinger -->-->
0not expected to doWebFinger
0phase<--<-- 1 --- Discovery -->-->
0provider_config
kwargs:{'issuer': 'https://cloud-api.loginradius.com/sso/oidc/v2/internal-mayank/oidctest'}
0http response
url:https://cloud-api.loginradius.com/sso/oidc/v2/internal-mayank/oidctest/.well-known/openid-configuration status_code:200
0ProviderConfigurationResponse
{
    "acr_values_supported": [
        "loginradius:nist:level:1:re-auth"
    ],
    "authorization_endpoint": "https://cloud-api.loginradius.com/sso/oidc/v2/oidctest/authorize",
    "backchannel_logout_session_supported": false,
    "backchannel_logout_supported": false,
    "claims_parameter_supported": false,
    "claims_supported": [
        "profile",
        "email_verified",
        "phone_number",
        "updated_at",
        "email",
        "address",
        "preferred_username",
        "picture",
        "zoneinfo",
        "Country",
        "given_name",
        "nickname",
        "family_name",
        "UserName",
        "middle_name",
        "LastName",
        "phone_number_verified",
        "name",
        "locale",
        "auth_time",
        "Uid",
        "Favicon",
        "website",
        "gender",
        "FirstName",
        "CustomFields.customerid",
        "birthdate",
        "acr"
    ],
    "frontchannel_logout_session_supported": false,
    "frontchannel_logout_supported": false,
    "grant_types_supported": [
        "authorization_code",
        "refresh_token"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "issuer": "https://cloud-api.loginradius.com/sso/oidc/v2/internal-mayank/oidctest",
    "jwks_uri": "https://cloud-api.loginradius.com/sso/oidc/v2/internal-mayank/oidctest/jwks",
    "request_parameter_supported": false,
    "request_uri_parameter_supported": true,
    "require_request_uri_registration": false,
    "response_modes_supported": [
        "query",
        "form_post",
        "fragment"
    ],
    "response_types_supported": [
        "code",
        "token",
        "id_token",
        "code token",
        "code id_token",
        "token id_token",
        "code token id_token"
    ],
    "revocation_endpoint": "https://cloud-api.loginradius.com/sso/oidc/v2/oidctest/revoke",
    "scopes_supported": [
        "openid",
        "email",
        "phone",
        "profile",
        "address"
    ],
    "subject_types_supported": [
        "public"
    ],
    "token_endpoint": "https://cloud-api.loginradius.com/sso/oidc/v2/oidctest/token",
    "token_endpoint_auth_methods_supported": [
        "client_secret_post",
        "client_secret_basic"
    ],
    "userinfo_endpoint": "https://cloud-api.loginradius.com/sso/oidc/v2/internal-mayank/oidctest/userinfo",
    "version": "3.0"
}
0phase<--<-- 2 --- Registration -->-->
0not expected to doDynamic registration
0phase<--<-- 3 --- AsyncAuthn -->-->
0AuthorizationRequest
{
    "claims": {
        "userinfo": {
            "name": {
                "essential": true
            }
        }
    },
    "client_id": "112563f6-1480-40b8-8e28-e072ca212c82",
    "nonce": "waxDYutNeTcSf3ct",
    "redirect_uri": "https://op.certification.openid.net:61949/authz_cb",
    "response_type": "code",
    "scope": "openid",
    "state": "RuVvCkh9ZuVZCztk"
}
0redirect urlhttps://cloud-api.loginradius.com/sso/oidc/v2/oidctest/authorize?state=RuVvCkh9ZuVZCztk&nonce=waxDYutNeTcSf3ct&response_type=code&scope=openid&redirect_uri=https%3A%2F%2Fop.certification.openid.net%3A61949%2Fauthz_cb&claims=%7B%22userinfo%22%3A+%7B%22name%22%3A+%7B%22essential%22%3A+true%7D%7D%7D&client_id=112563f6-1480-40b8-8e28-e072ca212c82
0redirecthttps://cloud-api.loginradius.com/sso/oidc/v2/oidctest/authorize?state=RuVvCkh9ZuVZCztk&nonce=waxDYutNeTcSf3ct&response_type=code&scope=openid&redirect_uri=https%3A%2F%2Fop.certification.openid.net%3A61949%2Fauthz_cb&claims=%7B%22userinfo%22%3A+%7B%22name%22%3A+%7B%22essential%22%3A+true%7D%7D%7D&client_id=112563f6-1480-40b8-8e28-e072ca212c82
7responseResponse URL with query part
7response{'state': 'RuVvCkh9ZuVZCztk', 'code': '08974c6b7a43c75ab202a3b7ae02aed3:ae5b812c0e1d5582a9984e28a8a87a4fa08f7331c8b41f9d606ddb9a5289298505d7113be9b87481670125eb716635c10f1c3ac37894dac624d54ec699ed3aa8367200f9d5b9fb00370c1cde0be3c070d305fac5f2f33d0b290fec7daa11696dff279669d2741e16dae1ea77b5c75d58'}
7response{'state': 'RuVvCkh9ZuVZCztk', 'code': '08974c6b7a43c75ab202a3b7ae02aed3:ae5b812c0e1d5582a9984e28a8a87a4fa08f7331c8b41f9d606ddb9a5289298505d7113be9b87481670125eb716635c10f1c3ac37894dac624d54ec699ed3aa8367200f9d5b9fb00370c1cde0be3c070d305fac5f2f33d0b290fec7daa11696dff279669d2741e16dae1ea77b5c75d58'}
7AuthorizationResponse
{
    "code": "08974c6b7a43c75ab202a3b7ae02aed3:ae5b812c0e1d5582a9984e28a8a87a4fa08f7331c8b41f9d606ddb9a5289298505d7113be9b87481670125eb716635c10f1c3ac37894dac624d54ec699ed3aa8367200f9d5b9fb00370c1cde0be3c070d305fac5f2f33d0b290fec7daa11696dff279669d2741e16dae1ea77b5c75d58",
    "state": "RuVvCkh9ZuVZCztk"
}
7phase<--<-- 4 --- AccessToken -->-->
7requestop_args: {'state': 'RuVvCkh9ZuVZCztk'}, req_args: {'redirect_uri': 'https://op.certification.openid.net:61949/authz_cb'}
7do_access_token_request
kwargs:{'request_args': {'redirect_uri': 'https://op.certification.openid.net:61949/authz_cb', 'code': '08974c6b7a43c75ab202a3b7ae02aed3:ae5b812c0e1d5582a9984e28a8a87a4fa08f7331c8b41f9d606ddb9a5289298505d7113be9b87481670125eb716635c10f1c3ac37894dac624d54ec699ed3aa8367200f9d5b9fb00370c1cde0be3c070d305fac5f2f33d0b290fec7daa11696dff279669d2741e16dae1ea77b5c75d58', 'state': 'RuVvCkh9ZuVZCztk', 'grant_type': 'authorization_code', 'client_id': '112563f6-1480-40b8-8e28-e072ca212c82'}, 'state': 'RuVvCkh9ZuVZCztk', 'authn_method': 'client_secret_basic'}
7AccessTokenRequest
{
    "code": "08974c6b7a43c75ab202a3b7ae02aed3:ae5b812c0e1d5582a9984e28a8a87a4fa08f7331c8b41f9d606ddb9a5289298505d7113be9b87481670125eb716635c10f1c3ac37894dac624d54ec699ed3aa8367200f9d5b9fb00370c1cde0be3c070d305fac5f2f33d0b290fec7daa11696dff279669d2741e16dae1ea77b5c75d58",
    "grant_type": "authorization_code",
    "redirect_uri": "https://op.certification.openid.net:61949/authz_cb",
    "state": "RuVvCkh9ZuVZCztk"
}
7request_urlhttps://cloud-api.loginradius.com/sso/oidc/v2/oidctest/token
7request_http_args{'headers': {'Authorization': 'Basic MTEyNTYzZjYtMTQ4MC00MGI4LThlMjgtZTA3MmNhMjEyYzgyOjc4ZDNkYmUzLTEwZDEtNDk3Yi05MzU3LThlZWQ0NTkzMzYzZA==', 'Content-Type': 'application/x-www-form-urlencoded'}}
7requestgrant_type=authorization_code&redirect_uri=https%3A%2F%2Fop.certification.openid.net%3A61949%2Fauthz_cb&code=08974c6b7a43c75ab202a3b7ae02aed3%3Aae5b812c0e1d5582a9984e28a8a87a4fa08f7331c8b41f9d606ddb9a5289298505d7113be9b87481670125eb716635c10f1c3ac37894dac624d54ec699ed3aa8367200f9d5b9fb00370c1cde0be3c070d305fac5f2f33d0b290fec7daa11696dff279669d2741e16dae1ea77b5c75d58&state=RuVvCkh9ZuVZCztk
7http response
url:https://cloud-api.loginradius.com/sso/oidc/v2/oidctest/token status_code:200
7response{'access_token': '2c6e3c28-52f6-427b-af81-8686c286412e', 'token_type': 'Bearer', 'refresh_token': 'e8facee7-ad83-4a56-8edb-6ae92d9b0267', 'expires_in': 824, 'id_token': 'eyJhbGciOiJSUzI1NiIsImtpZCI6IjIwMSIsInR5cCI6IkpXVCJ9.eyJhZGRyZXNzIjp7ImNvdW50cnkiOm51bGwsImxvY2FsaXR5IjpudWxsLCJwb3N0YWxfY29kZSI6bnVsbCwicmVnaW9uIjpudWxsLCJzdHJlZXRfYWRkcmVzcyI6bnVsbH0sImFzZGZnaCI6IiIsImF1ZCI6IjExMjU2M2Y2LTE0ODAtNDBiOC04ZTI4LWUwNzJjYTIxMmM4MiIsImF1dGhfdGltZSI6MTU5NDI3ODYzMywiYmlydGhkYXRlIjoiMTk4Ny0wNy0wOCIsImNfaGFzaCI6IlQxLV8tVTh5TUR0RUZNVnVhWS1mUFEiLCJjb3VudHJ5IjpudWxsLCJlbWFpbCI6W3siVHlwZSI6IlByaW1hcnkiLCJWYWx1ZSI6ImNsb3Vkc3NvdGVzdEBtYWlsYXp5LmNvbSJ9XSwiZW1haWxfdmVyaWZpZWQiOnRydWUsImV4cCI6MTU5NDI3OTMwOCwiZmFtaWx5X25hbWUiOiJ0ZXNydCIsImZhdmljb24xIjpudWxsLCJmbmFtZSI6ImNsb3Vkc3NvdCIsImdlbmRlciI6bnVsbCwiZ2l2ZW5fbmFtZSI6ImNsb3Vkc3NvdCIsImlhdCI6MTU5NDI3ODcwOCwiaXNzIjoiaHR0cHM6Ly9jbG91ZC1hcGkubG9naW5yYWRpdXMuY29tL3Nzby9vaWRjL3YyL2ludGVybmFsLW1heWFuay9vaWRjdGVzdCIsImp0aSI6IjEwNmRmNjM1LTJmOTctNDRmZC1iZTA1LTY4N2VjYTdlYWFiZCIsImxuYW1lIjoidGVzcnQiLCJsb2NhbGUiOm51bGwsIm1pZGRsZV9uYW1lIjpudWxsLCJuYW1lIjoiY2xvdWRzc290IHRlc3J0IiwibmJmIjoxNTk0Mjc4NzA4LCJuaWNrbmFtZSI6bnVsbCwibm9uY2UiOiJ3YXhEWXV0TmVUY1NmM2N0IiwicGhvbmVfbnVtYmVyIjoiKzE5MDI5MDk1NzE0IiwicGhvbmVfbnVtYmVyX3ZlcmlmaWVkIjp0cnVlLCJwaWN0dXJlIjpudWxsLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJjbG91ZHNzb3Rlc3QiLCJwcm9maWxlIjpudWxsLCJzdWIiOiIwYjdmOTQ1YjhjNWY0YTM2YTM1YmY0OWY3MjM5YmZhNCIsInVpZCI6IjBiN2Y5NDViOGM1ZjRhMzZhMzViZjQ5ZjcyMzliZmE0IiwidXBkYXRlZF9hdCI6MTU2Mzg4NTEwOSwidXNlcm5hbWUiOiJjbG91ZHNzb3Rlc3QiLCJ3ZWJzaXRlIjpudWxsLCJ6b25laW5mbyI6bnVsbH0.dACyQEFLo1-kKzxQO5NpNWB_rAVVgKww7ucqr1k0dRC7Np1b6wXznH2cQodpb1JIhccda8mRg_AZlTXbYyTAV5YyLPdkGkRbsXjyV_DIXnycNAQOyubSdQFPbDmzc0WnVc-wOVOZiiNVSFJno7Th_3Bw_vvl2HAxCHYMDaSn5F0RY5BrT5ZRmVA07S8oaHJ0prXID8xzZZaP4F4tLmwwFl6UkIZyTqe1oheCOWghCJZ4c5WsEMojgbDGuqaKbKO3Ns6qEFAd3mFgmEzpbd7HY4LQo5Dtnjjv0djfETVqPfFcqCKU6vfPtkFFiLAsrIkiUf_LPY7nwSUF2IyQOcznEA'}
7AccessTokenResponse
{
    "access_token": "2c6e3c28-52f6-427b-af81-8686c286412e",
    "expires_in": 824,
    "id_token": {
        "address": {
            "country": null,
            "locality": null,
            "postal_code": null,
            "region": null,
            "street_address": null
        },
        "aud": [
            "112563f6-1480-40b8-8e28-e072ca212c82"
        ],
        "auth_time": 1594278633,
        "birthdate": "1987-07-08",
        "c_hash": "T1-_-U8yMDtEFMVuaY-fPQ",
        "country": null,
        "email": {
            "Type": "Primary",
            "Value": "cloudssotest@mailazy.com"
        },
        "email_verified": true,
        "exp": 1594279308,
        "family_name": "tesrt",
        "favicon1": null,
        "fname": "cloudssot",
        "gender": null,
        "given_name": "cloudssot",
        "iat": 1594278708,
        "iss": "https://cloud-api.loginradius.com/sso/oidc/v2/internal-mayank/oidctest",
        "jti": "106df635-2f97-44fd-be05-687eca7eaabd",
        "lname": "tesrt",
        "locale": null,
        "middle_name": null,
        "name": "cloudssot tesrt",
        "nbf": 1594278708,
        "nickname": null,
        "nonce": "waxDYutNeTcSf3ct",
        "phone_number": "+19029095714",
        "phone_number_verified": true,
        "picture": null,
        "preferred_username": "cloudssotest",
        "profile": null,
        "sub": "0b7f945b8c5f4a36a35bf49f7239bfa4",
        "uid": "0b7f945b8c5f4a36a35bf49f7239bfa4",
        "updated_at": 1563885109,
        "username": "cloudssotest",
        "website": null,
        "zoneinfo": null
    },
    "refresh_token": "e8facee7-ad83-4a56-8edb-6ae92d9b0267",
    "token_type": "Bearer"
}
7jws header{'alg': 'RS256', 'kid': '201', 'typ': 'JWT'}
7phase<--<-- 5 --- UserInfo -->-->
7do_user_info_request
kwargs:{'state': 'RuVvCkh9ZuVZCztk', 'method': 'GET', 'authn_method': 'bearer_header'}
7request{'body': None}
7request_urlhttps://cloud-api.loginradius.com/sso/oidc/v2/internal-mayank/oidctest/userinfo
7request_http_args{'headers': {'Authorization': 'Bearer 2c6e3c28-52f6-427b-af81-8686c286412e'}}
7http response
url:https://cloud-api.loginradius.com/sso/oidc/v2/internal-mayank/oidctest/userinfo status_code:200
7OpenIDSchema
{
    "name": "cloudssot tesrt",
    "sub": "0b7f945b8c5f4a36a35bf49f7239bfa4"
}
7OpenIDSchema
{
    "name": "cloudssot tesrt",
    "sub": "0b7f945b8c5f4a36a35bf49f7239bfa4"
}
7jws header{'alg': 'RS256', 'kid': '201', 'typ': 'JWT'}
7phase<--<-- 6 --- Done -->-->
7end
7assertionVerifyClaims
7conditionverify-claims: status=OK [Verifies that the claims returned as UserInfo or in the ID Token is consistent with what was asked for]
7assertionCheckHTTPResponse
7conditioncheck-http-response: status=OK [Checks that the HTTP response status is within the 200 or 300 range. Also does some extra JSON checks]
7conditionDone: status=OK

Result

PASSED

  • Version: 2.3.6