udap_security_test_kit 0.11.1 → 0.11.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/config/presets/UDAP_RunClientAgainstServer.json.erb +20 -0
- data/config/presets/UDAP_RunServerAgainstClient.json.erb +272 -0
- data/lib/udap_security_test_kit/client_credentials_token_exchange_test.rb +1 -1
- data/lib/udap_security_test_kit/client_suite/client_access_group.rb +22 -0
- data/lib/udap_security_test_kit/client_suite/client_access_interaction_test.rb +53 -0
- data/lib/udap_security_test_kit/client_suite/client_registration_group.rb +26 -0
- data/lib/udap_security_test_kit/client_suite/client_registration_interaction_test.rb +50 -0
- data/lib/udap_security_test_kit/client_suite/client_registration_verification_test.rb +244 -0
- data/lib/udap_security_test_kit/client_suite/client_token_request_verification_test.rb +178 -0
- data/lib/udap_security_test_kit/client_suite/client_token_use_verification_test.rb +43 -0
- data/lib/udap_security_test_kit/client_suite.rb +78 -0
- data/lib/udap_security_test_kit/docs/demo/FHIR Request.postman_collection.json +81 -0
- data/lib/udap_security_test_kit/docs/udap_client_suite_description.md +120 -0
- data/lib/udap_security_test_kit/endpoints/echoing_fhir_responder.rb +52 -0
- data/lib/udap_security_test_kit/endpoints/mock_udap_server/registration.rb +57 -0
- data/lib/udap_security_test_kit/endpoints/mock_udap_server/token.rb +27 -0
- data/lib/udap_security_test_kit/endpoints/mock_udap_server.rb +301 -0
- data/lib/udap_security_test_kit/metadata.rb +5 -5
- data/lib/udap_security_test_kit/tags.rb +8 -0
- data/lib/udap_security_test_kit/urls.rb +45 -0
- data/lib/udap_security_test_kit/version.rb +2 -1
- data/lib/udap_security_test_kit.rb +8 -2
- metadata +20 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 03620024d784bdef2def46c35503c0291eacf4bf0f613ccc546febd4b9502066
|
|
4
|
+
data.tar.gz: fe308df520fcfe3120aacfb66cc7191ab03de1eedee46da7b9775d88bb798dba
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 9482d4811cbcf5fb500b237684722e2835289470a4ffe72c3c53338aeecb433c5f5f855f88a741d346d1b614ff67a9ecb1e0c354296f85c3c40f45e4faea07d4
|
|
7
|
+
data.tar.gz: a41ee216e78fa02afec7d30e0ee1067dd306d7e72ac868c042e90efce1291d201a4347c8f73fee6b1688baba7bf50a523b37f602fed82d72d19db0f2d72f558d
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
{
|
|
2
|
+
"title": "Demo: Run Against the UDAP Security Server Suite",
|
|
3
|
+
"id": "udap_run_client_against_server",
|
|
4
|
+
"test_suite_id": "udap_security_client",
|
|
5
|
+
"inputs": [
|
|
6
|
+
{
|
|
7
|
+
"name": "udap_client_uri",
|
|
8
|
+
"description": "The UDAP Client URI that will be used to register with Inferno's simulated UDAP server.",
|
|
9
|
+
"optional": true,
|
|
10
|
+
"title": "UDAP Client URI",
|
|
11
|
+
"type": "text",
|
|
12
|
+
"value": "<%= Inferno::Application['base_url'] %>/custom/udap_security/fhir"
|
|
13
|
+
},
|
|
14
|
+
{
|
|
15
|
+
"name": "echoed_fhir_response",
|
|
16
|
+
"type": "text",
|
|
17
|
+
"value": "{\n \"resourceType\": \"Patient\",\n \"id\": \"example\",\n \"name\": [\n {\n \"family\": \"Chalmers\",\n \"given\": [\n \"Peter\",\n \"James\"\n ]\n }\n ],\n \"gender\": \"male\",\n \"birthDate\": \"1974-12-25\",\n \"address\": [\n {\n \"line\": [\n \"534 Erewhon St\"\n ],\n \"city\": \"Ann Arbor\",\n \"state\": \"MI\",\n \"postalCode\": \"48108\"\n }\n ]\n}"
|
|
18
|
+
}
|
|
19
|
+
]
|
|
20
|
+
}
|
|
@@ -0,0 +1,272 @@
|
|
|
1
|
+
{
|
|
2
|
+
"title": "Demo: Run Against the UDAP Security Client Suite",
|
|
3
|
+
"id": "udap_run_server_against_client",
|
|
4
|
+
"test_suite_id": "udap_security",
|
|
5
|
+
"inputs": [
|
|
6
|
+
{
|
|
7
|
+
"name": "udap_fhir_base_url",
|
|
8
|
+
"description": "Base FHIR URL of FHIR Server. Discovery request will be sent to {baseURL}/.well-known/udap",
|
|
9
|
+
"title": "FHIR Server Base URL",
|
|
10
|
+
"type": "text",
|
|
11
|
+
"value": "<%= Inferno::Application['base_url'] %>/custom/udap_security_client/fhir"
|
|
12
|
+
},
|
|
13
|
+
{
|
|
14
|
+
"name": "udap_community_parameter",
|
|
15
|
+
"description": "If included, the designated community value will be appended as a query to the well-known endpoint to indicate the client's trust of certificates from this trust community.",
|
|
16
|
+
"optional": true,
|
|
17
|
+
"title": "UDAP Community Parameter",
|
|
18
|
+
"type": "text",
|
|
19
|
+
"value": ""
|
|
20
|
+
},
|
|
21
|
+
{
|
|
22
|
+
"name": "flow_type_auth_code",
|
|
23
|
+
"default": [
|
|
24
|
+
"authorization_code"
|
|
25
|
+
],
|
|
26
|
+
"description": "Which grant type(s) must be supported per the returned Discovery metadata",
|
|
27
|
+
"locked": true,
|
|
28
|
+
"options": {
|
|
29
|
+
"list_options": [
|
|
30
|
+
{
|
|
31
|
+
"label": "Authorization Code",
|
|
32
|
+
"value": "authorization_code"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"label": "Client Credentials",
|
|
36
|
+
"value": "client_credentials"
|
|
37
|
+
}
|
|
38
|
+
]
|
|
39
|
+
},
|
|
40
|
+
"title": "Required OAuth2.0 Flow Type for Authorization Code Workflow",
|
|
41
|
+
"type": "checkbox",
|
|
42
|
+
"value": "[\"authorization_code\"]"
|
|
43
|
+
},
|
|
44
|
+
{
|
|
45
|
+
"name": "udap_server_trust_anchor_certs",
|
|
46
|
+
"description": "A list of one or more trust anchor root CA X.509 certificates, separated by a newline. Inferno will use these to establish trust with the authorization server's certificates provided in the discovery response signed_metadata JWT.",
|
|
47
|
+
"optional": true,
|
|
48
|
+
"title": "Auth Server Trust Anchor X509 Certificate(s) (PEM Format)",
|
|
49
|
+
"type": "textarea",
|
|
50
|
+
"value": "-----BEGIN CERTIFICATE-----\nMIIGDzCCA/egAwIBAgIUHwBisiqxYRNYzDtSvNRPOu09emswDQYJKoZIhvcNAQEL\nBQAwgYYxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJNQTEQMA4GA1UEBwwHQmVkZm9y\nZDEQMA4GA1UECgwHSW5mZXJubzEdMBsGA1UEAwwUSW5mZXJuby1VREFQLVJvb3Qt\nQ0ExJzAlBgkqhkiG9w0BCQEWGGluZmVybm9AZ3JvdXBzLm1pdHJlLm9yZzAeFw0y\nNDA4MTIyMzU4MDlaFw0zNDA4MTAyMzU4MDlaMIGGMQswCQYDVQQGEwJVUzELMAkG\nA1UECAwCTUExEDAOBgNVBAcMB0JlZGZvcmQxEDAOBgNVBAoMB0luZmVybm8xHTAb\nBgNVBAMMFEluZmVybm8tVURBUC1Sb290LUNBMScwJQYJKoZIhvcNAQkBFhhpbmZl\ncm5vQGdyb3Vwcy5taXRyZS5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK\nAoICAQC3Hz72FU3I4PFztBPpeDX7augTiw5KKMzEQWoOtsyx8de0lXLDaY13SugL\nwCduDei5WYaHat3/eAWnsvGb2VQjQOpfUTvdwnmvUSTAZH+EB+IPy/Jk2AbXtgGv\n8GcLsmjpZNiePvCrcOT28j9tTAdO8gKaIOg0XpYq/Kdyyecr1jMINKgUMOyoi//R\nQjzvx6dRq/YBegb2bEOe+YBUdo7EzAXZUAk48RelAq5b1vaqyhJeuOcxXxVCLjTi\nKN+Tje6FnmQkD/J7P05XlRFvoNxzp5X+92bcrZ+LcOjNy4wTxiT3f76e6DCMHRcM\n3QmhfU3cerv1pvb78peb0bKglzwdmquw+H6+UQrvmaCqCNWnVjmUzB1bgRxAc5YV\np18kHzNnUAoXHMU6+ZVHqvrbtNEBHYI5NUrgOCVBpFCRf53qRtfQjSIfJrKEoKvC\nvidDeW0YWy5FILZ50g+Auo/JvPLVUzm+qENN+y/at3LZx27VEoyZpi18DqbWWYNa\n+QnGow/rEf/fHRUrsTBhgttQ7/VhTr8M6KcsHLpqm7Ec6zPy6MvrFLowXsXWZGNq\nzhEb6YGHi9WzNDcsAILybRm4jDS07/1f1CJ6BJuQrPFDsVo4o0PhCsAWH5MqcL2V\nlKt/kfJxva83JoshB9zFNmtCdfuw/Mkl8i+OO5WR/vqIZNam9wIDAQABo3MwcTAd\nBgNVHQ4EFgQUNOqoPKju4u9y9JAuAfnSAcFbNKAwHwYDVR0jBBgwFoAUNOqoPKju\n4u9y9JAuAfnSAcFbNKAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAYYwEQYD\nVR0gBAowCDAGBgRVHSAAMA0GCSqGSIb3DQEBCwUAA4ICAQCbLfJy6q2r26iyKZ3x\nMNUorDfsiTWH8TspYBm6v3h4yn9U+9qbyBwsjCu0U2ns5VqHzw25jInW5FQbwZZV\nAiUYKNpn6gIWZKpWOaDYaMWB4Jv9BMLLsENkP6PM6XxAheBVj2WNrlXaOaBql7XQ\npkZ9TpX56Vim86Jk999o4idi4CWyaoZHXtwOGyKkOPp0xghg9VAX2y2xLYdBzgSs\nJW9P8+WIeIIbz3mpSlq0Aqh9LjneKW9wfinYEO/IxsMpOqAV54VtWJ9tMZtR8e83\ntNihJuWJvhA2rWXffh1/uPv7uA3Yge/a5vf+VfJn5MoSPn4X8ZRaJMmUFnyyvyzD\nK4fxAV2dCBjOsQtEU4pIWKwS8BopLdOcoM8Wyth+0KpxpCDTPBY0idxqU/Dg0wBe\n8YQ/mAN+cVZy2U0BoXEKlW49+czQ1wKAv4rzDJFTZUTudG+r4LmNFDPXnoiMwhni\nXkgFz1NO4YucWXBestvBSDgQ2BPFF2TkcGZl7bLk+WiGAhA/SxtLvHjIKqXwGYHG\nm8C45sJ7h0h0zdmd3/ImHWRd6D99k5eFyX5O2qNoa6v6w5rRqE7gZCe/0yZVpdth\nhhXWl1vLHPiRE5N+vRgOW1i66Ly2I7WwX965erNDxEgNCvgsP84FjbMs/2Xnb3Be\ntsGvVZ6GCrAl5XejmwQBzyZQQw==\n-----END CERTIFICATE-----\n"
|
|
51
|
+
},
|
|
52
|
+
{
|
|
53
|
+
"name": "udap_auth_code_flow_registration_grant_type",
|
|
54
|
+
"default": "authorization_code",
|
|
55
|
+
"description": "The OAuth2.0 grant type for which this client will register itself. A given client may register as either option, but not both.",
|
|
56
|
+
"locked": true,
|
|
57
|
+
"options": {
|
|
58
|
+
"list_options": [
|
|
59
|
+
{
|
|
60
|
+
"label": "Authorization Code",
|
|
61
|
+
"value": "authorization_code"
|
|
62
|
+
},
|
|
63
|
+
{
|
|
64
|
+
"label": "Client Credentials",
|
|
65
|
+
"value": "client_credentials"
|
|
66
|
+
}
|
|
67
|
+
]
|
|
68
|
+
},
|
|
69
|
+
"title": "Client Registration Grant Type",
|
|
70
|
+
"type": "radio",
|
|
71
|
+
"value": "authorization_code"
|
|
72
|
+
},
|
|
73
|
+
{
|
|
74
|
+
"name": "udap_auth_code_flow_client_registration_status",
|
|
75
|
+
"default": "new",
|
|
76
|
+
"description": "If the client's iss and certificate combination has already been registered with the authorization server prior to this test run, select 'Update'.",
|
|
77
|
+
"options": {
|
|
78
|
+
"list_options": [
|
|
79
|
+
{
|
|
80
|
+
"label": "New Registration (201 Response Code Expected)",
|
|
81
|
+
"value": "new"
|
|
82
|
+
},
|
|
83
|
+
{
|
|
84
|
+
"label": "Update Registration (200 or 201 Response Code Expected)",
|
|
85
|
+
"value": "update"
|
|
86
|
+
}
|
|
87
|
+
]
|
|
88
|
+
},
|
|
89
|
+
"title": "Client Registration Status",
|
|
90
|
+
"type": "radio",
|
|
91
|
+
"value": "new"
|
|
92
|
+
},
|
|
93
|
+
{
|
|
94
|
+
"name": "udap_auth_code_flow_client_cert_pem",
|
|
95
|
+
"description": "A list of one or more X.509 certificates in PEM format separated by a newline. The first (leaf) certificate MUST represent the client entity Inferno will register as, and the trust chain that will be built from the provided certificate(s) must resolve to a CA trusted by the authorization server under test.",
|
|
96
|
+
"title": "Authorization Code Client Certificate(s) (PEM Format)",
|
|
97
|
+
"type": "textarea",
|
|
98
|
+
"value": ""
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
"name": "udap_auth_code_flow_client_private_key",
|
|
102
|
+
"description": "The private key corresponding to the client certificate used for registration, in PEM format. Used to sign registration and/or authentication JWTs.",
|
|
103
|
+
"title": "Authorization Code Client Private Key (PEM Format)",
|
|
104
|
+
"type": "textarea",
|
|
105
|
+
"value": ""
|
|
106
|
+
},
|
|
107
|
+
{
|
|
108
|
+
"name": "udap_auth_code_flow_cert_iss",
|
|
109
|
+
"description": "MUST correspond to a unique URI entry in the Subject Alternative Name (SAN) extension of the client certificate used for registration.",
|
|
110
|
+
"title": "Authorization Code JWT Issuer (iss) Claim",
|
|
111
|
+
"type": "text",
|
|
112
|
+
"value": ""
|
|
113
|
+
},
|
|
114
|
+
{
|
|
115
|
+
"name": "udap_auth_code_flow_registration_scope",
|
|
116
|
+
"description": "String containing a space delimited list of scopes requested by the client application for use in subsequent requests. The Authorization Server MAY consider this list when deciding the scopes that it will allow the application to subsequently request. Apps requesting the \"authorization_code\" grant type SHOULD request user or patient scopes.",
|
|
117
|
+
"title": "Authorization Code Registration Requested Scope(s)",
|
|
118
|
+
"type": "text",
|
|
119
|
+
"value": ""
|
|
120
|
+
},
|
|
121
|
+
{
|
|
122
|
+
"name": "udap_jwt_signing_alg",
|
|
123
|
+
"default": "RS256",
|
|
124
|
+
"description": "Algorithm used to sign UDAP JSON Web Tokens (JWTs). UDAP Implementations SHALL support RS256.",
|
|
125
|
+
"locked": true,
|
|
126
|
+
"options": {
|
|
127
|
+
"list_options": [
|
|
128
|
+
{
|
|
129
|
+
"label": "RS256",
|
|
130
|
+
"value": "RS256"
|
|
131
|
+
}
|
|
132
|
+
]
|
|
133
|
+
},
|
|
134
|
+
"title": "JWT Signing Algorithm",
|
|
135
|
+
"type": "radio",
|
|
136
|
+
"value": "RS256"
|
|
137
|
+
},
|
|
138
|
+
{
|
|
139
|
+
"name": "udap_auth_code_flow_registration_certifications",
|
|
140
|
+
"description": "Additional UDAP certifications to include in registration request, if required by the authorization server. Include a space separated list of strings representing a Base64-encoded, signed JWT.",
|
|
141
|
+
"optional": true,
|
|
142
|
+
"title": "Authorization Code UDAP Registration Certifications",
|
|
143
|
+
"type": "textarea",
|
|
144
|
+
"value": ""
|
|
145
|
+
},
|
|
146
|
+
{
|
|
147
|
+
"name": "udap_authorization_code_request_scopes",
|
|
148
|
+
"description": "A list of space-separated scopes to include in the authorization request. If included, these may be equal to or a subset of the scopes requested during registration. If empty, scope will be omitted as a parameter to the authorization endpoint.",
|
|
149
|
+
"optional": true,
|
|
150
|
+
"title": "Scope Parameter for Authorization Request",
|
|
151
|
+
"type": "text",
|
|
152
|
+
"value": ""
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"name": "udap_authorization_code_request_aud",
|
|
156
|
+
"description": "If selected, the Base FHIR URL will be used as the 'aud' parameter in the request to the authorization endpoint.",
|
|
157
|
+
"optional": true,
|
|
158
|
+
"options": {
|
|
159
|
+
"list_options": [
|
|
160
|
+
{
|
|
161
|
+
"label": "Include 'aud' parameter",
|
|
162
|
+
"value": "include_aud"
|
|
163
|
+
}
|
|
164
|
+
]
|
|
165
|
+
},
|
|
166
|
+
"title": "Audience ('aud') Parameter for Authorization Request",
|
|
167
|
+
"type": "checkbox",
|
|
168
|
+
"value": "[]"
|
|
169
|
+
},
|
|
170
|
+
{
|
|
171
|
+
"name": "flow_type_client_creds",
|
|
172
|
+
"default": [
|
|
173
|
+
"client_credentials"
|
|
174
|
+
],
|
|
175
|
+
"description": "Which grant type(s) must be supported per the returned Discovery metadata",
|
|
176
|
+
"locked": true,
|
|
177
|
+
"optional": "false",
|
|
178
|
+
"options": {
|
|
179
|
+
"list_options": [
|
|
180
|
+
{
|
|
181
|
+
"label": "Authorization Code",
|
|
182
|
+
"value": "authorization_code"
|
|
183
|
+
},
|
|
184
|
+
{
|
|
185
|
+
"label": "Client Credentials",
|
|
186
|
+
"value": "client_credentials"
|
|
187
|
+
}
|
|
188
|
+
]
|
|
189
|
+
},
|
|
190
|
+
"title": "Required OAuth2.0 Flow Type for Client Credentials Workflow",
|
|
191
|
+
"type": "checkbox",
|
|
192
|
+
"value": "[\"client_credentials\"]"
|
|
193
|
+
},
|
|
194
|
+
{
|
|
195
|
+
"name": "udap_client_credentials_flow_registration_grant_type",
|
|
196
|
+
"default": "client_credentials",
|
|
197
|
+
"description": "The OAuth2.0 grant type for which this client will register itself. A given client may register as either option, but not both.",
|
|
198
|
+
"locked": true,
|
|
199
|
+
"options": {
|
|
200
|
+
"list_options": [
|
|
201
|
+
{
|
|
202
|
+
"label": "Authorization Code",
|
|
203
|
+
"value": "authorization_code"
|
|
204
|
+
},
|
|
205
|
+
{
|
|
206
|
+
"label": "Client Credentials",
|
|
207
|
+
"value": "client_credentials"
|
|
208
|
+
}
|
|
209
|
+
]
|
|
210
|
+
},
|
|
211
|
+
"title": "Client Registration Grant Type",
|
|
212
|
+
"type": "radio",
|
|
213
|
+
"value": "client_credentials"
|
|
214
|
+
},
|
|
215
|
+
{
|
|
216
|
+
"name": "udap_client_credentials_flow_client_registration_status",
|
|
217
|
+
"default": "new",
|
|
218
|
+
"description": "If the client's iss and certificate combination has already been registered with the authorization server prior to this test run, select 'Update'.",
|
|
219
|
+
"options": {
|
|
220
|
+
"list_options": [
|
|
221
|
+
{
|
|
222
|
+
"label": "New Registration (201 Response Code Expected)",
|
|
223
|
+
"value": "new"
|
|
224
|
+
},
|
|
225
|
+
{
|
|
226
|
+
"label": "Update Registration (200 or 201 Response Code Expected)",
|
|
227
|
+
"value": "update"
|
|
228
|
+
}
|
|
229
|
+
]
|
|
230
|
+
},
|
|
231
|
+
"title": "Client Registration Status",
|
|
232
|
+
"type": "radio",
|
|
233
|
+
"value": "new"
|
|
234
|
+
},
|
|
235
|
+
{
|
|
236
|
+
"name": "udap_client_credentials_flow_client_cert_pem",
|
|
237
|
+
"description": "A list of one or more X.509 certificates in PEM format separated by a newline. The first (leaf) certificate MUST represent the client entity Inferno will register as, and the trust chain that will be built from the provided certificate(s) must resolve to a CA trusted by the authorization server under test.",
|
|
238
|
+
"title": "Client Credentials Client Certificate(s) (PEM Format)",
|
|
239
|
+
"type": "textarea",
|
|
240
|
+
"value": "-----BEGIN CERTIFICATE-----\nMIIFcjCCA1qgAwIBAgIUbdCfB3IJ9bdOPGQVtxJHhMxUWv0wDQYJKoZIhvcNAQEL\nBQAwgYYxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJNQTEQMA4GA1UEBwwHQmVkZm9y\nZDEQMA4GA1UECgwHSW5mZXJubzEdMBsGA1UEAwwUSW5mZXJuby1VREFQLVJvb3Qt\nQ0ExJzAlBgkqhkiG9w0BCQEWGGluZmVybm9AZ3JvdXBzLm1pdHJlLm9yZzAeFw0y\nNDA4MTIyMzU4MTBaFw0zNDA4MTAyMzU4MTBaMGExCzAJBgNVBAYTAlVTMQswCQYD\nVQQIDAJNQTEQMA4GA1UEBwwHQmVkZm9yZDEQMA4GA1UECgwHSW5mZXJubzEhMB8G\nA1UEAwwYVURBUCBFeGFtcGxlIFRlc3QgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAnfqzJCyeFNRhlcsrUPiO2LQtudObDHUKj4Q7fkYPUf9X\necTMckfPKd8UJ7x8Vb5o1zmR3hsMoo1A7IkwBkmK2BXvxq243cCGO1q4w/jdL/EG\nDiIZjTr7qvkawyeh9cAaApOrBlD4gnOxB05GjingDZgiT7GqBwrpEB2XJ4tw4idS\nB3W9Rv0ynbgqPKgGw9hnEef+uNAvFIvSbfdz1n4xHNP0GuMuAX+edFCyxYFmDe74\n8pl3TH9dxkoM945r5tHmuJS9n1pXkTB9L5RVbqH77dIyOBobehHHpT4D3zjdSFmh\nfta5NnDi5/iqRcFz7FVO79jJIoAqN+mWBlVH0yyfYQIDAQABo4H7MIH4MC8GA1Ud\nEQQoMCaGJGh0dHBzOi8vaW5mZXJuby5jb20vdWRhcF9zZWN1cml0eS9hYzAxBgNV\nHSUEKjAoBggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBggrBgEFBQcDBDA6\nBgNVHR8EMzAxMC+gLaArhilodHRwczovL2luZmVybm8uY29tL21vY2tfY3JsX2Vu\nZHBvaW50LmNybDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIHgDAdBgNVHQ4EFgQU6Eo2\nHE37gpSaW9zBGf0t7XfYnfIwHwYDVR0jBBgwFoAUNOqoPKju4u9y9JAuAfnSAcFb\nNKAwDQYJKoZIhvcNAQELBQADggIBACh2uQ1Krkw6F3Gq0HG3ohCm2j1ynmLSJwGE\nHvPlkiBcs8RBPxZzJOZJBMxGmjTPga2Kt6zsBlmjLg++C7C5/8JruwrMtrBuTtHx\nKky0Qw+YJm81IgATeDIU/qkJB8LcnHgkQbu3nyoyeKocx9XSW8nlEm4FkyREXxfC\nrSVCoc70GGg2vSnSkRikNjxwKGnHvmEDUOW2bBbbzvTGKlTKSIF50NiNPM3Fi7vF\nbOfi1aZh6m8IKVaI2KUXVFHco1qB3QDK5BUEimko+EyaWSZPvP83PE2+TIdapRrw\nHxQQJEr774GUNH1/hdW0qlP4u3CMMMAjS2H4dOsRYOOmgC6iEewFEBQqTRLkEfgP\npMxYhGAVAmrglLLr4t+ZF9KOmifvB6f18qF352Bj1D0TMB+oLy67kFw3s2ah21la\n3Xm6hQt+M5mZ/EYZIOUPxMHtqVt5DSJdMENHO2cjcRARyeD/BGYnJqnf6yA1LL2V\nTK+jhC/C/Dcv0hHQnVWlUGlwoFMOOzfsr2K3mXYezAuHASP8LIAyjodPpd6cLQu2\nSZTVVobSebaNmZ2UeX8Bc9bcobM2bbVb2c3UeezEJWOpt5cSOeEScEiwkaktxD5p\nix1K3KkIg2yDP176ILlVqBBA0X2FqTSSvFbTa5us3XIwkDfARJBpLnA7OfmsO61+\nIj5io7+X\n-----END CERTIFICATE-----"
|
|
241
|
+
},
|
|
242
|
+
{
|
|
243
|
+
"name": "udap_client_credentials_flow_client_private_key",
|
|
244
|
+
"description": "The private key corresponding to the client certificate used for registration, in PEM format. Used to sign registration and/or authentication JWTs.",
|
|
245
|
+
"title": "Client Credentials Client Private Key (PEM Format)",
|
|
246
|
+
"type": "textarea",
|
|
247
|
+
"value": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCd+rMkLJ4U1GGV\nyytQ+I7YtC2505sMdQqPhDt+Rg9R/1d5xMxyR88p3xQnvHxVvmjXOZHeGwyijUDs\niTAGSYrYFe/GrbjdwIY7WrjD+N0v8QYOIhmNOvuq+RrDJ6H1wBoCk6sGUPiCc7EH\nTkaOKeANmCJPsaoHCukQHZcni3DiJ1IHdb1G/TKduCo8qAbD2GcR5/640C8Ui9Jt\n93PWfjEc0/Qa4y4Bf550ULLFgWYN7vjymXdMf13GSgz3jmvm0ea4lL2fWleRMH0v\nlFVuofvt0jI4Ght6EcelPgPfON1IWaF+1rk2cOLn+KpFwXPsVU7v2MkigCo36ZYG\nVUfTLJ9hAgMBAAECggEAApTpPosYHkEGQztpvs4BD5uKL8I8g2yaOpQvoLWmZHGm\nzU+hA7EWuplxq+CRq5kL/5BqSNXqU/G5AOSRC1lCUpuxKm8GWWFfEDNAV7uGadUn\ngy2de0heeoHNpSjNpcV451fgcJ78IK2hU/w8fPBEQBSfYuwFWk4cVu4U3UmTE68I\nO7PpCdTjk70IOsLT8uBagAOw92Fj0mGU7agCdWfJ+LjPRUtg+PhVvODatL3taG+l\nFAParsomiRqKGINyn8vALXNISuBYHVDUzv93P10gG5rA2sJ7953/+++Hr9DoLpmL\nSH/q/LebFzPJ2u6KzLc6bam1YX0w/MSNTJVIxA5V/QKBgQDU+iFXdShLwvEXGVtb\nFdZuRk3XsN+yfkFyM9SZrmaLF2VBALkC5pd+rYkXSaTA/cbs623VOYpoJhVmjL8d\nVvTlN/G+8TzfdsmOlAXiOSiUn3VKM/Othu5l9k0AgylU8aXBWTUv5FzmV8gMn+/s\n9oOucAVFa60LdkR2d609y/tKnwKBgQC95Gviall3E/+7drT05KxPPGDKRUjhCLBe\nBNj2+ttSt4+v+E5v3K+LSd11VfGkvLkDvkhjiJlVamf+XgLne3TLrEThAKq8ySUr\nXKBRi+nfmisUHSrMGljHw500Rx+MR/LEpfEERMosLQWTrOTz5VG2RueVHbWbD622\nWitr8tnV/wKBgGDYUNr9GlLBFXJEhIc5ueUxMOp4sm/u+4Gb0fwEEvsCq3dQhdCs\n3IytCp69TR65B4DqWWpRHP/Y+XhFXg5QYVHuC46hEeYnlOWxp69EAJD8pZAVaaQp\nrDRPOJqYCe5nZ9Ew6H+bnybbGcur2qTtP9nNdIgpu2lv4RfhubRVEjLPAoGAXqzb\nSSii8GbNMwcNU6gLbPn6e/6tRl1RqZ6bGhCadxREFIUlfko2T6kFPDIcZ3kceYxO\nhSme4WJK9RykMAtygPWj5daySauz13m4CNBMS4qO/dlI9DgSmY6i+2SWixd4J6lg\nkDNH5VyREj66bAuigNG7NrJ4UBYyEt/EFG8hQrsCgYEAyLwk7f2Wgu9ykdwSrrQE\nTBK0iOVUcwPhxj1UbFyDxPdO0EspyKtIFD5w/sbBtQbJGSUFd7ZPoCsYkT2yAsDp\n3cI/ubRxA+/GaqUo84QxvJ4Uqdu8YS8C0FCEnhXGjA60Y5HFzufJF5EqfzwNctCr\nG0cRyX/4Ut4BNUcir/CRVL0=\n-----END PRIVATE KEY-----"
|
|
248
|
+
},
|
|
249
|
+
{
|
|
250
|
+
"name": "udap_cert_iss_client_creds_flow",
|
|
251
|
+
"description": "MUST correspond to a unique URI entry in the Subject Alternative Name (SAN) extension of the client certificate used for registration.",
|
|
252
|
+
"title": "Client Credentials JWT Issuer (iss) Claim",
|
|
253
|
+
"type": "text",
|
|
254
|
+
"value": "<%= Inferno::Application['base_url'] %>/custom/udap_security/fhir"
|
|
255
|
+
},
|
|
256
|
+
{
|
|
257
|
+
"name": "udap_client_credentials_flow_registration_scope",
|
|
258
|
+
"description": "String containing a space delimited list of scopes requested by the client application for use in subsequent requests. The Authorization Server MAY consider this list when deciding the scopes that it will allow the application to subsequently request. Apps requesting the \"client_credentials\" grant type SHOULD request system scopes.",
|
|
259
|
+
"title": "Client Credentials Registration Requested Scope(s)",
|
|
260
|
+
"type": "text",
|
|
261
|
+
"value": "system/*.read"
|
|
262
|
+
},
|
|
263
|
+
{
|
|
264
|
+
"name": "udap_client_creds_flow_registration_certifications",
|
|
265
|
+
"description": "Additional UDAP certifications to include in registration request, if required by the authorization server. Include a space separated list of strings representing a Base64-encoded, signed JWT.",
|
|
266
|
+
"optional": true,
|
|
267
|
+
"title": "Client Credentials UDAP Registration Certifications",
|
|
268
|
+
"type": "textarea",
|
|
269
|
+
"value": ""
|
|
270
|
+
}
|
|
271
|
+
]
|
|
272
|
+
}
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
require_relative 'client_access_interaction_test'
|
|
2
|
+
require_relative 'client_token_request_verification_test'
|
|
3
|
+
require_relative 'client_token_use_verification_test'
|
|
4
|
+
|
|
5
|
+
module UDAPSecurityTestKit
|
|
6
|
+
class UDAPClientAccess < Inferno::TestGroup
|
|
7
|
+
id :udap_client_access
|
|
8
|
+
title 'Client Access'
|
|
9
|
+
description %(
|
|
10
|
+
During these tests, the client system will access Inferno's simulated
|
|
11
|
+
FHIR server by requesting an access token and making a FHIR request.
|
|
12
|
+
Inferno will then verify that any token requests made were conformant
|
|
13
|
+
and that a token returned from a token request was used on an access request.
|
|
14
|
+
)
|
|
15
|
+
|
|
16
|
+
run_as_group
|
|
17
|
+
|
|
18
|
+
test from: :udap_client_access_interaction
|
|
19
|
+
test from: :udap_client_token_request_verification
|
|
20
|
+
test from: :udap_client_token_use_verification
|
|
21
|
+
end
|
|
22
|
+
end
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
require_relative '../urls'
|
|
2
|
+
require_relative '../endpoints/mock_udap_server'
|
|
3
|
+
|
|
4
|
+
module UDAPSecurityTestKit
|
|
5
|
+
class UDAPClientAccessInteraction < Inferno::Test
|
|
6
|
+
include URLs
|
|
7
|
+
|
|
8
|
+
id :udap_client_access_interaction
|
|
9
|
+
title 'Perform UDAP-secured Access'
|
|
10
|
+
description %(
|
|
11
|
+
During this test, Inferno will wait for the client to access data
|
|
12
|
+
using a UDAP token obtained during an earlier test.
|
|
13
|
+
)
|
|
14
|
+
input :client_id,
|
|
15
|
+
title: 'Client Id',
|
|
16
|
+
type: 'text',
|
|
17
|
+
locked: true,
|
|
18
|
+
description: %(
|
|
19
|
+
The registered Client Id for use in obtaining access tokens.
|
|
20
|
+
Create a new session if you need to change this value.
|
|
21
|
+
)
|
|
22
|
+
input :echoed_fhir_response,
|
|
23
|
+
title: 'FHIR Response to Echo',
|
|
24
|
+
type: 'textarea',
|
|
25
|
+
description: %(
|
|
26
|
+
JSON representation of a FHIR resource for Inferno to echo when a request
|
|
27
|
+
is made to the simulated FHIR server. The provided content will be echoed
|
|
28
|
+
back exactly and no check will be made that it is appropriate for the request
|
|
29
|
+
made. If nothing is provided, an OperationOutcome will be returned.
|
|
30
|
+
),
|
|
31
|
+
optional: true
|
|
32
|
+
|
|
33
|
+
run do
|
|
34
|
+
wait(
|
|
35
|
+
identifier: client_id,
|
|
36
|
+
message: %(
|
|
37
|
+
**Access**
|
|
38
|
+
|
|
39
|
+
Use the registered client id (#{client_id}) to obtain an access
|
|
40
|
+
token using the [UDAP B2B client credentials flow](https://hl7.org/fhir/us/udap-security/STU1/b2b.html)
|
|
41
|
+
and use that token to access a FHIR endpoint under the simulated server's base URL
|
|
42
|
+
|
|
43
|
+
`#{client_fhir_base_url}`
|
|
44
|
+
|
|
45
|
+
Inferno will echo the response provided in the **FHIR Response to Echo** input.
|
|
46
|
+
|
|
47
|
+
[Click here](#{client_resume_pass_url}?token=#{client_id}) once you performed
|
|
48
|
+
the access.
|
|
49
|
+
)
|
|
50
|
+
)
|
|
51
|
+
end
|
|
52
|
+
end
|
|
53
|
+
end
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
require_relative 'client_registration_interaction_test'
|
|
2
|
+
require_relative 'client_registration_verification_test'
|
|
3
|
+
|
|
4
|
+
module UDAPSecurityTestKit
|
|
5
|
+
class UDAPClientRegistration < Inferno::TestGroup
|
|
6
|
+
id :udap_client_registration
|
|
7
|
+
title 'Client Registration'
|
|
8
|
+
description %(
|
|
9
|
+
During these tests, the client system will dynamically register with Inferno's
|
|
10
|
+
simulated UDAP Server with the capabilities to perform the **UDAP B2B client credentials flow**.
|
|
11
|
+
At any time, the client may perform UDAP discovery on the simulated Inferno UDAP server.
|
|
12
|
+
)
|
|
13
|
+
run_as_group
|
|
14
|
+
|
|
15
|
+
input :udap_client_uri,
|
|
16
|
+
title: 'UDAP Client URI',
|
|
17
|
+
type: 'text',
|
|
18
|
+
description: %(
|
|
19
|
+
The UDAP Client URI that will be used to register with Inferno's simulated UDAP server.
|
|
20
|
+
),
|
|
21
|
+
optional: false
|
|
22
|
+
|
|
23
|
+
test from: :udap_client_registration_interaction
|
|
24
|
+
test from: :udap_client_registration_verification
|
|
25
|
+
end
|
|
26
|
+
end
|
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
require_relative '../urls'
|
|
2
|
+
require_relative '../endpoints/mock_udap_server'
|
|
3
|
+
|
|
4
|
+
module UDAPSecurityTestKit
|
|
5
|
+
class UDAPClientRegistrationInteraction < Inferno::Test
|
|
6
|
+
include URLs
|
|
7
|
+
|
|
8
|
+
id :udap_client_registration_interaction
|
|
9
|
+
title 'Perform UDAP Registration'
|
|
10
|
+
description %(
|
|
11
|
+
During this test, Inferno will wait for the client to register
|
|
12
|
+
themselves as a UDAP client with Inferno's simulated UDAP server
|
|
13
|
+
using UDAP dynamic registration.
|
|
14
|
+
)
|
|
15
|
+
input :udap_client_uri,
|
|
16
|
+
optional: false
|
|
17
|
+
|
|
18
|
+
output :client_id
|
|
19
|
+
|
|
20
|
+
run do
|
|
21
|
+
omit_if udap_client_uri.blank?, # for re-use: mark the udap_client_uri input as optional when importing to enable
|
|
22
|
+
'Not configured for UDAP authentication.'
|
|
23
|
+
|
|
24
|
+
generated_client_id = MockUDAPServer.client_uri_to_client_id(udap_client_uri)
|
|
25
|
+
output client_id: generated_client_id
|
|
26
|
+
|
|
27
|
+
wait(
|
|
28
|
+
identifier: generated_client_id,
|
|
29
|
+
message: %(
|
|
30
|
+
**UDAP Registration**
|
|
31
|
+
|
|
32
|
+
Make a UDAP dyanmic registration request to the UDAP-protected FHIR Server at
|
|
33
|
+
|
|
34
|
+
`#{client_fhir_base_url}`
|
|
35
|
+
|
|
36
|
+
For Client URI
|
|
37
|
+
|
|
38
|
+
`#{udap_client_uri}`
|
|
39
|
+
|
|
40
|
+
Metadata on Inferno's simulated UDAP server can be found at
|
|
41
|
+
|
|
42
|
+
`#{client_udap_discovery_url}`
|
|
43
|
+
|
|
44
|
+
[Click here](#{client_resume_pass_url}?token=#{generated_client_id}) once you have
|
|
45
|
+
succesfully completed the registration.
|
|
46
|
+
)
|
|
47
|
+
)
|
|
48
|
+
end
|
|
49
|
+
end
|
|
50
|
+
end
|