udap_security_test_kit 0.11.5 → 0.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/udap_security_test_kit/authorization_code_received_test.rb +8 -0
- data/lib/udap_security_test_kit/authorization_code_redirect_test.rb +3 -0
- data/lib/udap_security_test_kit/authorization_code_token_exchange_test.rb +2 -0
- data/lib/udap_security_test_kit/authorization_endpoint_field_test.rb +5 -1
- data/lib/udap_security_test_kit/client_suite/access_ac_group.rb +2 -0
- data/lib/udap_security_test_kit/client_suite/authorization_request_verification_test.rb +5 -0
- data/lib/udap_security_test_kit/client_suite/registration_ac_verification_test.rb +34 -0
- data/lib/udap_security_test_kit/client_suite/registration_cc_verification_test.rb +30 -0
- data/lib/udap_security_test_kit/client_suite/token_request_ac_verification_test.rb +47 -0
- data/lib/udap_security_test_kit/client_suite/token_request_cc_verification_test.rb +25 -0
- data/lib/udap_security_test_kit/client_suite.rb +11 -0
- data/lib/udap_security_test_kit/discovery_group.rb +2 -0
- data/lib/udap_security_test_kit/dynamic_client_registration_group.rb +3 -0
- data/lib/udap_security_test_kit/endpoints/mock_udap_server.rb +2 -2
- data/lib/udap_security_test_kit/grant_types_supported_field_test.rb +3 -0
- data/lib/udap_security_test_kit/reg_endpoint_jwt_signing_alg_values_supported_field_test.rb +6 -0
- data/lib/udap_security_test_kit/registration_endpoint_field_test.rb +3 -0
- data/lib/udap_security_test_kit/registration_failure_invalid_contents_test.rb +4 -1
- data/lib/udap_security_test_kit/registration_failure_invalid_jwt_signature_test.rb +2 -0
- data/lib/udap_security_test_kit/registration_success_contents_test.rb +3 -0
- data/lib/udap_security_test_kit/registration_success_test.rb +3 -0
- data/lib/udap_security_test_kit/requirements/generated/udap-security-test-kit_requirements_coverage.csv +317 -0
- data/lib/udap_security_test_kit/requirements/generated/udap_security_client_requirements_coverage.csv +146 -0
- data/lib/udap_security_test_kit/requirements/generated/udap_security_requirements_coverage.csv +164 -0
- data/lib/udap_security_test_kit/requirements/hl7.fhir.us.udap-security_1.0.0_reqs.xlsx +0 -0
- data/lib/udap_security_test_kit/requirements/udap_security_test_kit_requirements.csv +308 -0
- data/lib/udap_security_test_kit/signed_metadata_contents_test.rb +17 -0
- data/lib/udap_security_test_kit/signed_metadata_field_test.rb +4 -1
- data/lib/udap_security_test_kit/token_endpoint_auth_methods_supported_field_test.rb +2 -0
- data/lib/udap_security_test_kit/token_endpoint_auth_signing_alg_values_supported_field_test.rb +5 -0
- data/lib/udap_security_test_kit/token_endpoint_field_test.rb +3 -0
- data/lib/udap_security_test_kit/udap_auth_extensions_required_field_test.rb +3 -0
- data/lib/udap_security_test_kit/udap_auth_extensions_supported_field_test.rb +3 -0
- data/lib/udap_security_test_kit/udap_certifications_required_field_test.rb +3 -0
- data/lib/udap_security_test_kit/udap_certifications_supported_field_test.rb +2 -0
- data/lib/udap_security_test_kit/udap_profiles_supported_field_test.rb +5 -0
- data/lib/udap_security_test_kit/udap_versions_supported_field_test.rb +2 -0
- data/lib/udap_security_test_kit/version.rb +2 -2
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/b2b_authorization_extension_object_test.rb +77 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/client_authorization_code_usage_test.rb +47 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/client_security_csrf_protection_test.rb +50 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/cryptographic_algorithms_test.rb +44 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/data_holder_auth_request_scope_test.rb +42 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/idp_authentication_compliance_test.rb +44 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/idp_supports_required_scopes_test.rb +42 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/jti_reuse_prevention_test.rb +44 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/metadata_interpretation_test.rb +47 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/oauth2_protocol_compliance_test.rb +50 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/preferred_identity_provider_test.rb +45 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/private_key_authentication_test.rb +47 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/resource_holder_authentication_test.rb +45 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/software_statement_registration_test.rb +49 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/token_request_authentication_test.rb +51 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/trust_community_query_parameters_test.rb +43 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/validation_confidentiality_test.rb +49 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/client_attestation_group.rb +48 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/authentication_requests_group/authentication_request_construction_test.rb +56 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/authentication_requests_group/authentication_request_validation_test.rb +60 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/authentication_requests_group.rb +13 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/authorization_code_token_requests_group/access_token_lifetime_test.rb +42 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/authorization_code_token_requests_group/access_token_request_validation_test.rb +51 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/authorization_code_token_requests_group/authorization_code_usage_test.rb +45 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/authorization_code_token_requests_group/resource_holder_authorization_flow_test.rb +37 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/authorization_code_token_requests_group.rb +17 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/client_authentication_group/client_certificate_storage_test.rb +36 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/client_authentication_group/no_client_credentials_native_apps_test.rb +38 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/client_authentication_group.rb +13 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/dynamic_client_registration_group/certification_handling_test.rb +45 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/dynamic_client_registration_group/client_id_modification_test.rb +42 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/dynamic_client_registration_group/dynamic_client_registration_validation_test.rb +48 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/dynamic_client_registration_group.rb +15 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/error_handling_group/deny_token_request_test.rb +42 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/error_handling_group/general_error_response_test.rb +39 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/error_handling_group/invalid_id_token_test.rb +43 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/error_handling_group/invalid_idp_test.rb +39 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/error_handling_group/invalid_redirection_uri_test.rb +43 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/error_handling_group/prompt_none_test.rb +39 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/error_handling_group/state_mismatch_test.rb +43 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/error_handling_group/unauthenticated_user_test.rb +42 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/error_handling_group/valid_state_error_response_test.rb +43 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/error_handling_group.rb +27 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/id_token_access_token_validation_group/access_token_validation_test.rb +47 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/id_token_access_token_validation_group/id_token_validation_test.rb +45 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/id_token_access_token_validation_group/token_response_validation_test.rb +47 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/id_token_access_token_validation_group.rb +15 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/identity_provider_interaction_group/idp_authentication_request_test.rb +45 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/identity_provider_interaction_group/idp_dynamic_registration_test.rb +45 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/identity_provider_interaction_group/idp_metadata_validation_test.rb +44 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/identity_provider_interaction_group/idp_token_exchange_test.rb +46 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/identity_provider_interaction_group.rb +17 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/jwt_security_group/jwt_certificate_chain_validation_test.rb +36 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/jwt_security_group/jwt_grant_parameter_validation_test.rb +36 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/jwt_security_group/jwt_jti_reuse_test.rb +35 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/jwt_security_group/jwt_signature_validation_test.rb +36 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/jwt_security_group/jwt_token_request_validation_test.rb +43 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/jwt_security_group.rb +19 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/metadata_server_capabilities_group/udap_authorization_extensions_required_test.rb +43 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/metadata_server_capabilities_group/udap_community_parameter_support_test.rb +44 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/metadata_server_capabilities_group/udap_metadata_endpoint_error_handling_test.rb +43 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/metadata_server_capabilities_group/udap_metadata_representation_test.rb +42 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/metadata_server_capabilities_group/udap_profiles_supported_test.rb +43 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/metadata_server_capabilities_group.rb +19 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/security_measures_group/csrf_protection_test.rb +49 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/security_measures_group/obtain_authorization_scopes_test.rb +44 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/security_measures_group/state_parameter_test.rb +48 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/security_measures_group/unauthenticated_client_security_test.rb +47 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server/security_measures_group.rb +17 -0
- data/lib/udap_security_test_kit/visual_inspection_and_attestation/server_attestation_group.rb +33 -0
- data/lib/udap_security_test_kit/well_known_endpoint_test.rb +4 -0
- data/lib/udap_security_test_kit.rb +10 -0
- metadata +85 -4
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 389308da43499f5da9c609232c1cc3fdaf1032878d896036c748fad5ad559e5b
|
|
4
|
+
data.tar.gz: fede0634c5887c1269335e23a43f7eafd2ead88f7023e7ddad38c461afebf14a
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: '0889a1e651666db51b2e6ab9f3bea0adcfc03c0e6f63a94e485a85351f3adf145a645bc1da3f385ad488f5fa22517ab0868e005a710a6caa43be9698a3d642c2'
|
|
7
|
+
data.tar.gz: 1bdf5d418b6eb50172a0d9365b3e3013bbfd163ebec2bb68d9b4427a4fa806f31e8e7587c2c4cb018ba5dde83d70b586b881ffb58045ee542210425e484028f5
|
|
@@ -9,12 +9,20 @@ module UDAPSecurityTestKit
|
|
|
9
9
|
output :udap_authorization_code
|
|
10
10
|
uses_request :redirect
|
|
11
11
|
|
|
12
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@133',
|
|
13
|
+
'hl7.fhir.us.udap-security_1.0.0@134',
|
|
14
|
+
'hl7.fhir.us.udap-security_1.0.0@138',
|
|
15
|
+
'hl7.fhir.us.udap-security_1.0.0@190'
|
|
16
|
+
|
|
12
17
|
run do
|
|
13
18
|
code = request.query_parameters['code']
|
|
14
19
|
output udap_authorization_code: code
|
|
15
20
|
|
|
16
21
|
assert code.present?, 'No `code` parameter received'
|
|
17
22
|
|
|
23
|
+
state = request.query_parameters['state']
|
|
24
|
+
assert state.present?, '`state` parameter is required since it was present in client request'
|
|
25
|
+
|
|
18
26
|
error = request.query_parameters['error']
|
|
19
27
|
|
|
20
28
|
pass_if error.blank?
|
|
@@ -13,6 +13,10 @@ module UDAPSecurityTestKit
|
|
|
13
13
|
input :udap_well_known_metadata_json
|
|
14
14
|
output :udap_authorization_endpoint
|
|
15
15
|
|
|
16
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@9',
|
|
17
|
+
'hl7.fhir.us.udap-security_1.0.0@38',
|
|
18
|
+
'hl7.fhir.us.udap-security_1.0.0@39'
|
|
19
|
+
|
|
16
20
|
run do
|
|
17
21
|
assert_valid_json(udap_well_known_metadata_json)
|
|
18
22
|
config = JSON.parse(udap_well_known_metadata_json)
|
|
@@ -29,7 +33,7 @@ module UDAPSecurityTestKit
|
|
|
29
33
|
'`authorization_endpoint` field is only required if `authorization_code` is a supported grant type'
|
|
30
34
|
|
|
31
35
|
assert config.key?('authorization_endpoint'),
|
|
32
|
-
'`authorization_endpoint` field is required if `
|
|
36
|
+
'`authorization_endpoint` field is required if `authorization_code` is a supported grant type'
|
|
33
37
|
|
|
34
38
|
endpoint = config['authorization_endpoint']
|
|
35
39
|
|
|
@@ -17,6 +17,8 @@ module UDAPSecurityTestKit
|
|
|
17
17
|
|
|
18
18
|
run_as_group
|
|
19
19
|
|
|
20
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@126'
|
|
21
|
+
|
|
20
22
|
test from: :udap_client_access_ac_interaction
|
|
21
23
|
test from: :udap_client_authorization_request_verification
|
|
22
24
|
test from: :udap_client_token_request_ac_verification
|
|
@@ -24,6 +24,11 @@ module UDAPSecurityTestKit
|
|
|
24
24
|
locked: 'true',
|
|
25
25
|
description: INPUT_UDAP_REGISTRATION_JWT_DESCRIPTION_LOCKED
|
|
26
26
|
|
|
27
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@67',
|
|
28
|
+
'hl7.fhir.us.udap-security_1.0.0@127',
|
|
29
|
+
'hl7.fhir.us.udap-security_1.0.0@128',
|
|
30
|
+
'hl7.fhir.us.udap-security_1.0.0@129'
|
|
31
|
+
|
|
27
32
|
def client_suite_id
|
|
28
33
|
return config.options[:endpoint_suite_id] if config.options[:endpoint_suite_id].present?
|
|
29
34
|
|
|
@@ -17,6 +17,40 @@ module UDAPSecurityTestKit
|
|
|
17
17
|
input :udap_client_uri
|
|
18
18
|
output :udap_registration_jwt
|
|
19
19
|
|
|
20
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@1',
|
|
21
|
+
'hl7.fhir.us.udap-security_1.0.0@2',
|
|
22
|
+
'hl7.fhir.us.udap-security_1.0.0@3',
|
|
23
|
+
'hl7.fhir.us.udap-security_1.0.0@7',
|
|
24
|
+
'hl7.fhir.us.udap-security_1.0.0@8',
|
|
25
|
+
'hl7.fhir.us.udap-security_1.0.0@66',
|
|
26
|
+
'hl7.fhir.us.udap-security_1.0.0@71',
|
|
27
|
+
'hl7.fhir.us.udap-security_1.0.0@72',
|
|
28
|
+
'hl7.fhir.us.udap-security_1.0.0@73',
|
|
29
|
+
'hl7.fhir.us.udap-security_1.0.0@74',
|
|
30
|
+
'hl7.fhir.us.udap-security_1.0.0@75',
|
|
31
|
+
'hl7.fhir.us.udap-security_1.0.0@76',
|
|
32
|
+
'hl7.fhir.us.udap-security_1.0.0@77',
|
|
33
|
+
'hl7.fhir.us.udap-security_1.0.0@78',
|
|
34
|
+
'hl7.fhir.us.udap-security_1.0.0@79',
|
|
35
|
+
'hl7.fhir.us.udap-security_1.0.0@80',
|
|
36
|
+
'hl7.fhir.us.udap-security_1.0.0@81',
|
|
37
|
+
'hl7.fhir.us.udap-security_1.0.0@83',
|
|
38
|
+
'hl7.fhir.us.udap-security_1.0.0@84',
|
|
39
|
+
'hl7.fhir.us.udap-security_1.0.0@86',
|
|
40
|
+
'hl7.fhir.us.udap-security_1.0.0@87',
|
|
41
|
+
'hl7.fhir.us.udap-security_1.0.0@88',
|
|
42
|
+
'hl7.fhir.us.udap-security_1.0.0@90',
|
|
43
|
+
'hl7.fhir.us.udap-security_1.0.0@91',
|
|
44
|
+
'hl7.fhir.us.udap-security_1.0.0@92',
|
|
45
|
+
'hl7.fhir.us.udap-security_1.0.0@93',
|
|
46
|
+
'hl7.fhir.us.udap-security_1.0.0@94',
|
|
47
|
+
'hl7.fhir.us.udap-security_1.0.0@96',
|
|
48
|
+
'hl7.fhir.us.udap-security_1.0.0@97',
|
|
49
|
+
'hl7.fhir.us.udap-security_1.0.0@101',
|
|
50
|
+
'hl7.fhir.us.udap-security_1.0.0@102',
|
|
51
|
+
'hl7.fhir.us.udap-security_1.0.0@103',
|
|
52
|
+
'hl7.fhir.us.udap-security_1.0.0@104'
|
|
53
|
+
|
|
20
54
|
def client_suite_id
|
|
21
55
|
return config.options[:endpoint_suite_id] if config.options[:endpoint_suite_id].present?
|
|
22
56
|
|
|
@@ -23,6 +23,36 @@ module UDAPSecurityTestKit
|
|
|
23
23
|
UDAPSecurityTestKit::UDAPSecurityClientTestSuite.id
|
|
24
24
|
end
|
|
25
25
|
|
|
26
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@1',
|
|
27
|
+
'hl7.fhir.us.udap-security_1.0.0@2',
|
|
28
|
+
'hl7.fhir.us.udap-security_1.0.0@3',
|
|
29
|
+
'hl7.fhir.us.udap-security_1.0.0@7',
|
|
30
|
+
'hl7.fhir.us.udap-security_1.0.0@8',
|
|
31
|
+
'hl7.fhir.us.udap-security_1.0.0@66',
|
|
32
|
+
'hl7.fhir.us.udap-security_1.0.0@71',
|
|
33
|
+
'hl7.fhir.us.udap-security_1.0.0@72',
|
|
34
|
+
'hl7.fhir.us.udap-security_1.0.0@73',
|
|
35
|
+
'hl7.fhir.us.udap-security_1.0.0@74',
|
|
36
|
+
'hl7.fhir.us.udap-security_1.0.0@75',
|
|
37
|
+
'hl7.fhir.us.udap-security_1.0.0@76',
|
|
38
|
+
'hl7.fhir.us.udap-security_1.0.0@77',
|
|
39
|
+
'hl7.fhir.us.udap-security_1.0.0@78',
|
|
40
|
+
'hl7.fhir.us.udap-security_1.0.0@79',
|
|
41
|
+
'hl7.fhir.us.udap-security_1.0.0@80',
|
|
42
|
+
'hl7.fhir.us.udap-security_1.0.0@81',
|
|
43
|
+
'hl7.fhir.us.udap-security_1.0.0@83',
|
|
44
|
+
'hl7.fhir.us.udap-security_1.0.0@85',
|
|
45
|
+
'hl7.fhir.us.udap-security_1.0.0@86',
|
|
46
|
+
'hl7.fhir.us.udap-security_1.0.0@87',
|
|
47
|
+
'hl7.fhir.us.udap-security_1.0.0@92',
|
|
48
|
+
'hl7.fhir.us.udap-security_1.0.0@95',
|
|
49
|
+
'hl7.fhir.us.udap-security_1.0.0@96',
|
|
50
|
+
'hl7.fhir.us.udap-security_1.0.0@97',
|
|
51
|
+
'hl7.fhir.us.udap-security_1.0.0@101',
|
|
52
|
+
'hl7.fhir.us.udap-security_1.0.0@102',
|
|
53
|
+
'hl7.fhir.us.udap-security_1.0.0@103',
|
|
54
|
+
'hl7.fhir.us.udap-security_1.0.0@104'
|
|
55
|
+
|
|
26
56
|
run do
|
|
27
57
|
client_registration_requests = load_registration_requests_for_client_uri(udap_client_uri)
|
|
28
58
|
skip_if client_registration_requests.empty?,
|
|
@@ -28,6 +28,53 @@ module UDAPSecurityTestKit
|
|
|
28
28
|
description: INPUT_UDAP_REGISTRATION_JWT_DESCRIPTION_LOCKED
|
|
29
29
|
output :udap_tokens
|
|
30
30
|
|
|
31
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@1',
|
|
32
|
+
'hl7.fhir.us.udap-security_1.0.0@2',
|
|
33
|
+
'hl7.fhir.us.udap-security_1.0.0@3',
|
|
34
|
+
'hl7.fhir.us.udap-security_1.0.0@7',
|
|
35
|
+
'hl7.fhir.us.udap-security_1.0.0@8',
|
|
36
|
+
'hl7.fhir.us.udap-security_1.0.0@67',
|
|
37
|
+
'hl7.fhir.us.udap-security_1.0.0@69',
|
|
38
|
+
'hl7.fhir.us.udap-security_1.0.0@140',
|
|
39
|
+
'hl7.fhir.us.udap-security_1.0.0@141',
|
|
40
|
+
'hl7.fhir.us.udap-security_1.0.0@142',
|
|
41
|
+
'hl7.fhir.us.udap-security_1.0.0@143',
|
|
42
|
+
'hl7.fhir.us.udap-security_1.0.0@145',
|
|
43
|
+
'hl7.fhir.us.udap-security_1.0.0@151',
|
|
44
|
+
'hl7.fhir.us.udap-security_1.0.0@152',
|
|
45
|
+
'hl7.fhir.us.udap-security_1.0.0@153',
|
|
46
|
+
'hl7.fhir.us.udap-security_1.0.0@154',
|
|
47
|
+
'hl7.fhir.us.udap-security_1.0.0@155',
|
|
48
|
+
'hl7.fhir.us.udap-security_1.0.0@156',
|
|
49
|
+
'hl7.fhir.us.udap-security_1.0.0@157',
|
|
50
|
+
'hl7.fhir.us.udap-security_1.0.0@158',
|
|
51
|
+
'hl7.fhir.us.udap-security_1.0.0@160',
|
|
52
|
+
'hl7.fhir.us.udap-security_1.0.0@161',
|
|
53
|
+
'hl7.fhir.us.udap-security_1.0.0@163',
|
|
54
|
+
'hl7.fhir.us.udap-security_1.0.0@165',
|
|
55
|
+
'hl7.fhir.us.udap-security_1.0.0@166',
|
|
56
|
+
'hl7.fhir.us.udap-security_1.0.0@167',
|
|
57
|
+
'hl7.fhir.us.udap-security_1.0.0@168',
|
|
58
|
+
'hl7.fhir.us.udap-security_1.0.0@169',
|
|
59
|
+
'hl7.fhir.us.udap-security_1.0.0@170',
|
|
60
|
+
'hl7.fhir.us.udap-security_1.0.0@171',
|
|
61
|
+
'hl7.fhir.us.udap-security_1.0.0@175',
|
|
62
|
+
'hl7.fhir.us.udap-security_1.0.0@177',
|
|
63
|
+
'hl7.fhir.us.udap-security_1.0.0@178',
|
|
64
|
+
'hl7.fhir.us.udap-security_1.0.0@179',
|
|
65
|
+
'hl7.fhir.us.udap-security_1.0.0@180',
|
|
66
|
+
'hl7.fhir.us.udap-security_1.0.0@185',
|
|
67
|
+
'hl7.fhir.us.udap-security_1.0.0@192',
|
|
68
|
+
'hl7.fhir.us.udap-security_1.0.0@193',
|
|
69
|
+
'hl7.fhir.us.udap-security_1.0.0@194',
|
|
70
|
+
'hl7.fhir.us.udap-security_1.0.0@195',
|
|
71
|
+
'hl7.fhir.us.udap-security_1.0.0@196',
|
|
72
|
+
'hl7.fhir.us.udap-security_1.0.0@197',
|
|
73
|
+
'hl7.fhir.us.udap-security_1.0.0@222',
|
|
74
|
+
'hl7.fhir.us.udap-security_1.0.0@232',
|
|
75
|
+
'hl7.fhir.us.udap-security_1.0.0@233',
|
|
76
|
+
'hl7.fhir.us.udap-security_1.0.0@234'
|
|
77
|
+
|
|
31
78
|
def client_suite_id
|
|
32
79
|
return config.options[:endpoint_suite_id] if config.options[:endpoint_suite_id].present?
|
|
33
80
|
|
|
@@ -28,6 +28,31 @@ module UDAPSecurityTestKit
|
|
|
28
28
|
description: INPUT_UDAP_REGISTRATION_JWT_DESCRIPTION_LOCKED
|
|
29
29
|
output :udap_tokens
|
|
30
30
|
|
|
31
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@1',
|
|
32
|
+
'hl7.fhir.us.udap-security_1.0.0@2',
|
|
33
|
+
'hl7.fhir.us.udap-security_1.0.0@3',
|
|
34
|
+
'hl7.fhir.us.udap-security_1.0.0@7',
|
|
35
|
+
'hl7.fhir.us.udap-security_1.0.0@8',
|
|
36
|
+
'hl7.fhir.us.udap-security_1.0.0@67',
|
|
37
|
+
'hl7.fhir.us.udap-security_1.0.0@69',
|
|
38
|
+
'hl7.fhir.us.udap-security_1.0.0@186',
|
|
39
|
+
'hl7.fhir.us.udap-security_1.0.0@192',
|
|
40
|
+
'hl7.fhir.us.udap-security_1.0.0@193',
|
|
41
|
+
'hl7.fhir.us.udap-security_1.0.0@194',
|
|
42
|
+
'hl7.fhir.us.udap-security_1.0.0@195',
|
|
43
|
+
'hl7.fhir.us.udap-security_1.0.0@196',
|
|
44
|
+
'hl7.fhir.us.udap-security_1.0.0@197',
|
|
45
|
+
'hl7.fhir.us.udap-security_1.0.0@198',
|
|
46
|
+
'hl7.fhir.us.udap-security_1.0.0@202',
|
|
47
|
+
'hl7.fhir.us.udap-security_1.0.0@212',
|
|
48
|
+
'hl7.fhir.us.udap-security_1.0.0@214',
|
|
49
|
+
'hl7.fhir.us.udap-security_1.0.0@215',
|
|
50
|
+
'hl7.fhir.us.udap-security_1.0.0@223',
|
|
51
|
+
'hl7.fhir.us.udap-security_1.0.0@225',
|
|
52
|
+
'hl7.fhir.us.udap-security_1.0.0@226',
|
|
53
|
+
'hl7.fhir.us.udap-security_1.0.0@227',
|
|
54
|
+
'hl7.fhir.us.udap-security_1.0.0@228'
|
|
55
|
+
|
|
31
56
|
def client_suite_id
|
|
32
57
|
return config.options[:endpoint_suite_id] if config.options[:endpoint_suite_id].present?
|
|
33
58
|
|
|
@@ -8,6 +8,7 @@ require_relative 'client_suite/registration_ac_group'
|
|
|
8
8
|
require_relative 'client_suite/registration_cc_group'
|
|
9
9
|
require_relative 'client_suite/access_ac_group'
|
|
10
10
|
require_relative 'client_suite/access_cc_group'
|
|
11
|
+
require_relative 'visual_inspection_and_attestation/client_attestation_group'
|
|
11
12
|
|
|
12
13
|
module UDAPSecurityTestKit
|
|
13
14
|
class UDAPSecurityClientTestSuite < Inferno::TestSuite
|
|
@@ -15,6 +16,14 @@ module UDAPSecurityTestKit
|
|
|
15
16
|
title 'UDAP Security Client'
|
|
16
17
|
description File.read(File.join(__dir__, 'docs', 'udap_client_suite_description.md'))
|
|
17
18
|
|
|
19
|
+
requirement_sets(
|
|
20
|
+
{
|
|
21
|
+
identifier: 'hl7.fhir.us.udap-security_1.0.0',
|
|
22
|
+
title: 'Security for Scalable Registration, Authentication, and Authorization (UDAP)',
|
|
23
|
+
actor: 'Client'
|
|
24
|
+
}
|
|
25
|
+
)
|
|
26
|
+
|
|
18
27
|
links [
|
|
19
28
|
{
|
|
20
29
|
type: 'source_code',
|
|
@@ -105,5 +114,7 @@ module UDAPSecurityTestKit
|
|
|
105
114
|
required_suite_options: {
|
|
106
115
|
client_type: UDAPClientOptions::UDAP_CLIENT_CREDENTIALS
|
|
107
116
|
}
|
|
117
|
+
|
|
118
|
+
group from: :udap_client_v100_visual_inspection_and_attestation
|
|
108
119
|
end
|
|
109
120
|
end
|
|
@@ -61,6 +61,8 @@ module UDAPSecurityTestKit
|
|
|
61
61
|
output :udap_registration_endpoint
|
|
62
62
|
output :udap_registration_grant_type
|
|
63
63
|
|
|
64
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@15'
|
|
65
|
+
|
|
64
66
|
test from: :udap_well_known_endpoint
|
|
65
67
|
test from: :udap_versions_supported_field
|
|
66
68
|
test from: :udap_grant_types_supported_field
|
|
@@ -141,6 +141,9 @@ module UDAPSecurityTestKit
|
|
|
141
141
|
type: 'textarea',
|
|
142
142
|
optional: true
|
|
143
143
|
|
|
144
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@68',
|
|
145
|
+
'hl7.fhir.us.udap-security_1.0.0@105'
|
|
146
|
+
|
|
144
147
|
test from: :udap_registration_failure_invalid_contents
|
|
145
148
|
test from: :udap_registration_failure_invalid_jwt_signature
|
|
146
149
|
test from: :udap_registration_success
|
|
@@ -159,7 +159,7 @@ module UDAPSecurityTestKit
|
|
|
159
159
|
|
|
160
160
|
def decode_token(token)
|
|
161
161
|
token_to_decode =
|
|
162
|
-
if issued_token_is_refresh_token(token)
|
|
162
|
+
if issued_token_is_refresh_token?(token)
|
|
163
163
|
refresh_token_to_authorization_code(token)
|
|
164
164
|
else
|
|
165
165
|
token
|
|
@@ -175,7 +175,7 @@ module UDAPSecurityTestKit
|
|
|
175
175
|
decode_token(token)&.dig('client_id')
|
|
176
176
|
end
|
|
177
177
|
|
|
178
|
-
def issued_token_is_refresh_token(token)
|
|
178
|
+
def issued_token_is_refresh_token?(token)
|
|
179
179
|
token.end_with?('_rt')
|
|
180
180
|
end
|
|
181
181
|
|
|
@@ -13,6 +13,9 @@ module UDAPSecurityTestKit
|
|
|
13
13
|
input :required_flow_type
|
|
14
14
|
output :udap_registration_grant_type
|
|
15
15
|
|
|
16
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@36',
|
|
17
|
+
'hl7.fhir.us.udap-security_1.0.0@37'
|
|
18
|
+
|
|
16
19
|
run do
|
|
17
20
|
assert_valid_json(udap_well_known_metadata_json)
|
|
18
21
|
config = JSON.parse(udap_well_known_metadata_json)
|
|
@@ -16,6 +16,9 @@ module UDAPSecurityTestKit
|
|
|
16
16
|
|
|
17
17
|
input :udap_well_known_metadata_json
|
|
18
18
|
|
|
19
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@4',
|
|
20
|
+
'hl7.fhir.us.udap-security_1.0.0@45'
|
|
21
|
+
|
|
19
22
|
run do
|
|
20
23
|
assert_valid_json(udap_well_known_metadata_json)
|
|
21
24
|
config = JSON.parse(udap_well_known_metadata_json)
|
|
@@ -24,6 +27,9 @@ module UDAPSecurityTestKit
|
|
|
24
27
|
'`registration_endpoint_jwt_signing_alg_values_supported` field is recommended but not required'
|
|
25
28
|
|
|
26
29
|
CommonAssertions.assert_array_of_strings(config, 'registration_endpoint_jwt_signing_alg_values_supported')
|
|
30
|
+
|
|
31
|
+
assert config['registration_endpoint_jwt_signing_alg_values_supported'].include?('RS256'),
|
|
32
|
+
'All UDAP implementations must support RS256 signature algorithm'
|
|
27
33
|
end
|
|
28
34
|
end
|
|
29
35
|
end
|
|
@@ -12,6 +12,9 @@ module UDAPSecurityTestKit
|
|
|
12
12
|
input :udap_well_known_metadata_json
|
|
13
13
|
output :udap_registration_endpoint
|
|
14
14
|
|
|
15
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@11',
|
|
16
|
+
'hl7.fhir.us.udap-security_1.0.0@43'
|
|
17
|
+
|
|
15
18
|
run do
|
|
16
19
|
assert_valid_json(udap_well_known_metadata_json)
|
|
17
20
|
config = JSON.parse(udap_well_known_metadata_json)
|
|
@@ -8,7 +8,7 @@ module UDAPSecurityTestKit
|
|
|
8
8
|
description %(
|
|
9
9
|
The [UDAP IG Section 3.1](https://hl7.org/fhir/us/udap-security/STU1/registration.html#software-statement) states:
|
|
10
10
|
> The unique client URI used for the iss claim SHALL match the uriName entry in the Subject Alternative Name
|
|
11
|
-
> extension of the client app operator’s X.509 certificate, and SHALL
|
|
11
|
+
> extension of the client app operator’s X.509 certificate, and SHALL uniquelys identify a single client app
|
|
12
12
|
> operator and application over time
|
|
13
13
|
|
|
14
14
|
The [UDAP IG Section 3.2.3](https://hl7.org/fhir/us/udap-security/STU1/registration.html#request-body) states:
|
|
@@ -35,6 +35,9 @@ module UDAPSecurityTestKit
|
|
|
35
35
|
input :udap_registration_certifications,
|
|
36
36
|
optional: true
|
|
37
37
|
|
|
38
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@106',
|
|
39
|
+
'hl7.fhir.us.udap-security_1.0.0@114'
|
|
40
|
+
|
|
38
41
|
run do
|
|
39
42
|
software_statement_payload = SoftwareStatementBuilder.build_payload(
|
|
40
43
|
'invalid_iss',
|
|
@@ -43,6 +43,9 @@ module UDAPSecurityTestKit
|
|
|
43
43
|
|
|
44
44
|
output :udap_client_id
|
|
45
45
|
|
|
46
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@111',
|
|
47
|
+
'hl7.fhir.us.udap-security_1.0.0@113'
|
|
48
|
+
|
|
46
49
|
run do
|
|
47
50
|
assert_valid_json(udap_registration_response)
|
|
48
51
|
registration_response = JSON.parse(udap_registration_response)
|
|
@@ -39,6 +39,9 @@ module UDAPSecurityTestKit
|
|
|
39
39
|
output :udap_software_statement_json
|
|
40
40
|
output :udap_registration_response
|
|
41
41
|
|
|
42
|
+
verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@110',
|
|
43
|
+
'hl7.fhir.us.udap-security_1.0.0@119'
|
|
44
|
+
|
|
42
45
|
run do
|
|
43
46
|
software_statement_payload = SoftwareStatementBuilder.build_payload(
|
|
44
47
|
udap_cert_iss,
|