udap_security_test_kit 0.11.6 → 0.12.0

data/lib/udap_security_test_kit/requirements/generated/udap_security_requirements_coverage.csv

@@ -15,8 +15,8 @@ hl7.fhir.us.udap-security_1.0.0,13,https://hl7.org/fhir/us/udap-security/STU1/di
 hl7.fhir.us.udap-security_1.0.0,14,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#discovery-of-endpoints,"Servers **SHALL** allow access to the following metadata URL ... without requiring client authentication, where {baseURL} represents the base FHIR URL for the FHIR server: {baseURL}/.well-known/udap",SHALL,Server,,,,"1.1.01, 2.1.01","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_well_known_endpoint, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_well_known_endpoint"
 hl7.fhir.us.udap-security_1.0.0,15,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#discovery-of-endpoints,UDAP metadata **SHALL** be structured as a JSON object as per section 1 of [UDAP Server Metadata](https://www.udap.org/udap-server-metadata-stu1.html#section-1) and discussed further in [Section 2.2](https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata).,SHALL,Server,,,,"1.1, 2.1","udap_security-udap_authorization_code_group-auth_code_discovery_group, udap_security-udap_client_credentials_group-auth_code_discovery_group"
 hl7.fhir.us.udap-security_1.0.0,17,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#discovery-of-endpoints,"Servers conforming to this guide are generally expected, but not required, to also support the HL7 SMART App Launch Framework, which defines additional discovery and metadata requirements.",SHOULD,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,18,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,The metadata returned from the UDAP metadata endpoint … SHALL represent the server’s capabilities with respect to the UDAP workflows described in this guide.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,19,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"If no UDAP workflows are supported, the server SHALL return a `404 Not Found` response to the metadata request.",SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,18,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,The metadata returned from the UDAP metadata endpoint … SHALL represent the server’s capabilities with respect to the UDAP workflows described in this guide.,SHALL,Server,,,,3.1.04,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_metadata_server_capabilities_group-udap_security_metadata_representation
+hl7.fhir.us.udap-security_1.0.0,19,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"If no UDAP workflows are supported, the server SHALL return a `404 Not Found` response to the metadata request.",SHALL,Server,,,,3.1.03,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_metadata_server_capabilities_group-udap_security_metadata_error_handling
 hl7.fhir.us.udap-security_1.0.0,22,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"[When returning UDAP metadata, the] `udap_versions_supported` [element is] required [and SHALL be] A fixed array with one string element: [""1""]",SHALL,Server,,,,"1.1.02, 2.1.02","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_versions_supported_field, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_versions_supported_field"
 hl7.fhir.us.udap-security_1.0.0,23,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"[When returning UDAP metadata, the] `udap_profiles_supported` [element is] required
 [and SHALL contain a]n array of two or more strings identifying the core UDAP profiles supported by the Authorization Server.",SHALL,Server,,,,"1.1.04, 2.1.04","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_profiles_supported_field, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_profiles_supported_field"
@@ -26,13 +26,13 @@ hl7.fhir.us.udap-security_1.0.0,26,https://hl7.org/fhir/us/udap-security/STU1/di
 If the `grant_types_supported` parameter includes the string `""client_credentials""`, then the array SHALL also include:
 `""udap_authz""` for UDAP Client Authorization Grants using JSON Web Tokens to indicate support for Authorization Extension Objects.",SHALL,Server,true,,,"1.1.04, 2.1.04","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_profiles_supported_field, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_profiles_supported_field"
 hl7.fhir.us.udap-security_1.0.0,27,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"[When returning UDAP metadata] `udap_profiles_supported` [element]... 
-If the server supports the user authentication workflow described in [Section 6](https://hl7.org/fhir/us/udap-security/STU1/user.html#tiered-oauth-for-user-authentication), then the array SHALL also include: `""udap_to""` for UDAP Tiered OAuth for User Authentication.",SHALL,Server,true,,,"",""
+If the server supports the user authentication workflow described in [Section 6](https://hl7.org/fhir/us/udap-security/STU1/user.html#tiered-oauth-for-user-authentication), then the array SHALL also include: `""udap_to""` for UDAP Tiered OAuth for User Authentication.",SHALL,Server,true,,,3.1.05,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_metadata_server_capabilities_group-udap_security_profiles_supported
 hl7.fhir.us.udap-security_1.0.0,28,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"[When returning UDAP metadata, the] `udap_authorization_extensions_supported` [element is] required [and SHALL contain a]n array of zero or more recognized key names for Authorization Extension Objects supported by the Authorization Server.",SHALL,Server,,,,"1.1.05, 2.1.05","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_auth_extensions_supported_field, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_auth_extensions_supported_field"
 hl7.fhir.us.udap-security_1.0.0,29,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"If the Authorization Server supports the B2B Authorization Extension Object defined in Section [5.2.1.1](https://hl7.org/fhir/us/udap-security/STU1/b2b.html#b2b-authorization-extension-object), then the ... `[""hl7-b2b""]` key name SHALL be included [in the `udap_authorization_extensions_supported` element of the server's UDAP metadata].",SHALL,Server,,,,"1.1.05, 2.1.05","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_auth_extensions_supported_field, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_auth_extensions_supported_field"
 hl7.fhir.us.udap-security_1.0.0,30,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"[When returning UDAP metadata, the] `udap_authorization_extensions_required` [element SHALL contain when populated a]n array of zero or more recognized key names for Authorization Extension Objects required by the Authorization Server in every token request.",SHALL,Server,,,,"1.1.06, 2.1.06","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_auth_extensions_required_field, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_auth_extensions_required_field"
 hl7.fhir.us.udap-security_1.0.0,31,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"[When returning UDAP metadata, the] `udap_authorization_extensions_required` [element] SHALL be present if the value of the `udap_authorization_extensions_supported` parameter is not an empty array.",SHALL,Server,,,,"1.1.06, 2.1.06","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_auth_extensions_required_field, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_auth_extensions_required_field"
 hl7.fhir.us.udap-security_1.0.0,32,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"If the Authorization Server requires the B2B Authorization Extension Object defined in [Section 5.2.1.1](https://hl7.org/fhir/us/udap-security/STU1/b2b.html#b2b-authorization-extension-object) in every token request, then the following key name SHALL be included [in the `udap_authorization_extensions_required`list]:
-`[""hl7-b2b""]`",SHALL,Server,,,,"",""
+`[""hl7-b2b""]`",SHALL,Server,,,,3.1.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_metadata_server_capabilities_group-udap_security_authorization_extensions_required
 hl7.fhir.us.udap-security_1.0.0,33,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"[When returning UDAP metadata, the] `udap_certifications_supported` [element is] required [and SHALL contain a]n array of zero or more certification URIs supported by the Authorization Server, e.g.: `[""https://www.example.com/udap/profiles/example-certification""]`",SHALL,Server,,,,"1.1.07, 2.1.07","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_certifications_supported_field, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_certifications_supported_field"
 hl7.fhir.us.udap-security_1.0.0,34,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"[When returning UDAP metadata, the] `udap_certifications_required` [element SHALL contain when populated a]n array of zero or more certification URIs required by the Authorization Server.",SHALL,Server,,,,"1.1.08, 2.1.08","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_certifications_required_field, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_certifications_required_field"
 hl7.fhir.us.udap-security_1.0.0,35,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata,"[When returning UDAP metadata, the] `udap_certifications_required` … parameter SHALL be present if the value of the `udap_certifications_supported` parameter is not an empty array.",SHALL,Server,,,,"1.1.08, 2.1.08","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_certifications_required_field, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_certifications_required_field"
@@ -57,11 +57,11 @@ hl7.fhir.us.udap-security_1.0.0,52,https://hl7.org/fhir/us/udap-security/STU1/di
 hl7.fhir.us.udap-security_1.0.0,53,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#signed-metadata-elements,The exp time [in the Server's signed JWT] SHALL be no more than 1 year after the value of the iat claim.,SHALL,Server,,,,"1.1.17, 2.1.17","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_signed_metadata_contents, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_signed_metadata_contents"
 hl7.fhir.us.udap-security_1.0.0,54,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#signed-metadata-elements,"[The JWT in the signed_metadata element SHALL contain the claim] `iat` [that is the] Issued time integer for this JWT, expressed in seconds since the ""Epoch""",SHALL,Server,,,,"1.1.17, 2.1.17","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_signed_metadata_contents, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_signed_metadata_contents"
 hl7.fhir.us.udap-security_1.0.0,55,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#signed-metadata-elements,[The JWT in the signed_metadata element SHALL contain the claim] `jti` [that is a] nonce string value that uniquely identifies this JWT.,SHALL,Server,,,,"1.1.17, 2.1.17","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_signed_metadata_contents, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_signed_metadata_contents"
-hl7.fhir.us.udap-security_1.0.0,56,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#signed-metadata-elements,This [`jti`] value [in the Server's signed JWT] SHALL NOT be reused by the server in another JWT before the time specified in the exp claim has passed,SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,56,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#signed-metadata-elements,This [`jti`] value [in the Server's signed JWT] SHALL NOT be reused by the server in another JWT before the time specified in the exp claim has passed,SHALL,Server,,,,3.9.03,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_jwt_security_group-udap_security_jwt_jti_reuse
 hl7.fhir.us.udap-security_1.0.0,57,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#signed-metadata-elements,"[In the JWT in the signed_metadata element SHALL contain, the claim] `authorization_endpoint`[is] REQUIRED if the authorization_endpoint parameter is included in the unsigned metadata",SHALL,Server,,,,"1.1.17, 2.1.17","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_signed_metadata_contents, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_signed_metadata_contents"
 hl7.fhir.us.udap-security_1.0.0,58,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#signed-metadata-elements,[The JWT in the signed_metadata element SHALL contain the claim] `token_endpoint`[which is a] string containing the absolute URL of the server's token endpoint,SHALL,Server,,,,"1.1.17, 2.1.17","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_signed_metadata_contents, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_signed_metadata_contents"
 hl7.fhir.us.udap-security_1.0.0,59,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#signed-metadata-elements,[The JWT in the signed_metadata element SHALL contain the claim]  `registration_endpoint`[which is a] string containing the absolute URL of the server's registration endpoint,SHALL,Server,,,,"1.1.17, 2.1.17","udap_security-udap_authorization_code_group-auth_code_discovery_group-udap_signed_metadata_contents, udap_security-udap_client_credentials_group-auth_code_discovery_group-udap_signed_metadata_contents"
-hl7.fhir.us.udap-security_1.0.0,62,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#multiple-trust-communities,"If a server supports [the `community`] parameter and recognizes the URI value, it SHALL select a certificate intended for use within the identified trust community, if it has been issued such a certificate, and use that certificate when generating the signed JWT returned for the `signed_metadata` element.",SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,62,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#multiple-trust-communities,"If a server supports [the `community`] parameter and recognizes the URI value, it SHALL select a certificate intended for use within the identified trust community, if it has been issued such a certificate, and use that certificate when generating the signed JWT returned for the `signed_metadata` element.",SHALL,Server,,,,3.1.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_metadata_server_capabilities_group-udap_security_community_parameter_support
 hl7.fhir.us.udap-security_1.0.0,63,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#multiple-trust-communities,"If a server supports different UDAP capabilities for different communities, it MAY also return different values for other metadata elements described in [Section 2.2](https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata) as appropriate for the identified community.",MAY,Server,,,,"",""
 hl7.fhir.us.udap-security_1.0.0,64,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#multiple-trust-communities,"If the server does not recognize the community URI or does not have a suitable certificate for the identified community, it MAY return a `404 Not Found` response to the metadata request to indicate that no UDAP workflows are supported by server in the context of that community, or it MAY return its default metadata, i.e. the metadata that it would have returned if the community parameter was not included in the request.",MAY,Server,,,,"",""
 hl7.fhir.us.udap-security_1.0.0,65,https://hl7.org/fhir/us/udap-security/STU1/discovery.html#multiple-trust-communities,"If the server does not recognize the community URI or does not have a suitable certificate for the identified community, ..  it MAY return its default metadata, i.e. the metadata that it would have returned if the community parameter was not included in the request.",MAY,Server,,,,"",""
@@ -70,95 +70,95 @@ hl7.fhir.us.udap-security_1.0.0,89,https://hl7.org/fhir/us/udap-security/STU1/re
 hl7.fhir.us.udap-security_1.0.0,98,https://hl7.org/fhir/us/udap-security/STU1/registration.html#software-statement,The Authorization Server MAY consider this list [of scopes provided in the registration software statement] when deciding the scopes that it will allow the application to subsequently request.,MAY,Server,,,,"",""
 hl7.fhir.us.udap-security_1.0.0,105,https://hl7.org/fhir/us/udap-security/STU1/registration.html#request-body,The Authorization Server SHALL validate the registration request as per [Section 4](https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-4) of UDAP Dynamic Client Registration.,SHALL,Server,,,,"1.2, 2.2","udap_security-udap_authorization_code_group-auth_code_dcr_group, udap_security-udap_client_credentials_group-client_creds_dcr_group"
 hl7.fhir.us.udap-security_1.0.0,106,https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-4,[When validating a registration request t]he iss value MUST match a uriName entry in the Subject Alternative Names extension of the Client’s certificate.,SHALL,Server,,,,"1.2.01, 2.2.01","udap_security-udap_authorization_code_group-auth_code_dcr_group-udap_registration_failure_invalid_contents, udap_security-udap_client_credentials_group-client_creds_dcr_group-udap_registration_failure_invalid_contents"
-hl7.fhir.us.udap-security_1.0.0,107,https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-4,[When validating a registration request t]he sub value MUST match the iss value,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,108,https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-4,[When validating a registration request t]he aud value MUST contain the Authorization Server’s registration endpoint URL,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,109,https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-4,[When validating a registration request t]he software statement MUST be unexpired,SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,107,https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-4,[When validating a registration request t]he sub value MUST match the iss value,SHALL,Server,,,,3.2.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_dynamic_client_registration_group-udap_security_dynamic_client_registration_validation
+hl7.fhir.us.udap-security_1.0.0,108,https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-4,[When validating a registration request t]he aud value MUST contain the Authorization Server’s registration endpoint URL,SHALL,Server,,,,3.2.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_dynamic_client_registration_group-udap_security_dynamic_client_registration_validation
+hl7.fhir.us.udap-security_1.0.0,109,https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-4,[When validating a registration request t]he software statement MUST be unexpired,SHALL,Server,,,,3.2.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_dynamic_client_registration_group-udap_security_dynamic_client_registration_validation
 hl7.fhir.us.udap-security_1.0.0,110,https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-5.1,"If a new registration is successful, the Authorization Server SHALL return a registration response with a `201 Created` HTTP response code as per [Section 5.1](https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-5.1) of UDAP Dynamic Client Registration",SHALL,Server,,,,"1.2.03, 2.2.03","udap_security-udap_authorization_code_group-auth_code_dcr_group-udap_registration_success, udap_security-udap_client_credentials_group-client_creds_dcr_group-udap_registration_success"
 hl7.fhir.us.udap-security_1.0.0,111,https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-5.1,"[When responding to an authorization request that has been granted] 5.1 The top-level elements of the response SHALL include the client_id issued by the Authorization Server for use by the Client App, the software statement as submitted by the Client App, and all of the registration related parameters that were included in the software statement",SHALL,Server,,,,"1.2.04, 2.2.04","udap_security-udap_authorization_code_group-auth_code_dcr_group-udap_registration_success_contents, udap_security-udap_client_credentials_group-client_creds_dcr_group-udap_registration_success_contents"
-hl7.fhir.us.udap-security_1.0.0,112,https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-5.1,[When responding to an authorization request that has been granted] 5.1 Authorization Server MUST store the certificate provided by the Client for use to validate subsequent client authentication attempts.,SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,112,https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-5.1,[When responding to an authorization request that has been granted] 5.1 Authorization Server MUST store the certificate provided by the Client for use to validate subsequent client authentication attempts.,SHALL,Server,,,,3.8.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_client_authentication_group-udap_security_client_certificate_storage
 hl7.fhir.us.udap-security_1.0.0,113,https://hl7.org/fhir/us/udap-security/STU1/registration.html#request-body,"If a new registration is successful, the Authorization Server SHALL return a registration response ... including the unique `client_id` assigned by the Authorization Server to that client app.",SHALL,Server,,,,"1.2.04, 2.2.04","udap_security-udap_authorization_code_group-auth_code_dcr_group-udap_registration_success_contents, udap_security-udap_client_credentials_group-client_creds_dcr_group-udap_registration_success_contents"
 hl7.fhir.us.udap-security_1.0.0,114,https://hl7.org/fhir/us/udap-security/STU1/registration.html#request-body,"If a new registration is not successful, e.g. it is rejected by the server for any reason, the Authorization Server SHALL return an error response as per [Section 5.2](https://www.udap.org/udap-dynamic-client-registration-stu1.html#section-5.2) of UDAP Dynamic Client Registration.",SHALL,Server,,,,"1.2.01, 1.2.02, 2.2.01, 2.2.02","udap_security-udap_authorization_code_group-auth_code_dcr_group-udap_registration_failure_invalid_contents, udap_security-udap_authorization_code_group-auth_code_dcr_group-udap_registration_failure_invalid_jwt_signature, udap_security-udap_client_credentials_group-client_creds_dcr_group-udap_registration_failure_invalid_contents, udap_security-udap_client_credentials_group-client_creds_dcr_group-udap_registration_failure_invalid_jwt_signature"
-hl7.fhir.us.udap-security_1.0.0,116,https://hl7.org/fhir/us/udap-security/STU1/registration.html#inclusion-of-certifications-and-endorsements,Authorization Servers SHALL ignore unsupported or unrecognized certifications,SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,116,https://hl7.org/fhir/us/udap-security/STU1/registration.html#inclusion-of-certifications-and-endorsements,Authorization Servers SHALL ignore unsupported or unrecognized certifications,SHALL,Server,,,,3.2.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_dynamic_client_registration_group-udap_security_certification_handling
 hl7.fhir.us.udap-security_1.0.0,117,https://hl7.org/fhir/us/udap-security/STU1/registration.html#inclusion-of-certifications-and-endorsements,Authorization Servers MAY require registration requests to include one or more certifications.,MAY,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,118,https://hl7.org/fhir/us/udap-security/STU1/registration.html#inclusion-of-certifications-and-endorsements,"If an Authorization Server requires the inclusion of a certain certification, then the Authorization Server SHALL communicate this by including the corresponding certification URI in the `udap_certifications_required` element of its UDAP metadata.",SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,118,https://hl7.org/fhir/us/udap-security/STU1/registration.html#inclusion-of-certifications-and-endorsements,"If an Authorization Server requires the inclusion of a certain certification, then the Authorization Server SHALL communicate this by including the corresponding certification URI in the `udap_certifications_required` element of its UDAP metadata.",SHALL,Server,,,,3.2.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_dynamic_client_registration_group-udap_security_certification_handling
 hl7.fhir.us.udap-security_1.0.0,119,https://hl7.org/fhir/us/udap-security/STU1/registration.html#modifying-and-cancelling-registrations,"If an Authorization Server receives a valid registration request with a software statement containing the same `iss` value as an earlier software statement but with a different set of claims or claim values, or with a different (possibly empty) set of optional certifications and endorsements, the server SHALL treat this as a request to modify the registration parameters for the client application by replacing the information from the previous registration request with the information included in the new request.",SHALL,Server,,,,"1.2.03, 2.2.03","udap_security-udap_authorization_code_group-auth_code_dcr_group-udap_registration_success, udap_security-udap_client_credentials_group-client_creds_dcr_group-udap_registration_success"
 hl7.fhir.us.udap-security_1.0.0,120,https://hl7.org/fhir/us/udap-security/STU1/registration.html#modifying-and-cancelling-registrations,"If the registration modification request is accepted, the Authorization Server SHOULD return the same `client_id` in the registration response as for the previous registration.",SHOULD,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,121,https://hl7.org/fhir/us/udap-security/STU1/registration.html#modifying-and-cancelling-registrations,"If it returns a different `client_id` [in response to a registration modification request], it SHALL cancel the registration for the previous `client_id`.",SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,121,https://hl7.org/fhir/us/udap-security/STU1/registration.html#modifying-and-cancelling-registrations,"If it returns a different `client_id` [in response to a registration modification request], it SHALL cancel the registration for the previous `client_id`.",SHALL,Server,,,,3.2.03,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_dynamic_client_registration_group-udap_security_client_id_modification
 hl7.fhir.us.udap-security_1.0.0,122,https://hl7.org/fhir/us/udap-security/STU1/registration.html#modifying-and-cancelling-registrations,"If an Authorization Server receives a valid registration request with a software statement that contains an empty `grant_types` array from a previously registered application, the server SHOULD interpret this as a request to cancel the previous registration.",SHOULD,Server,,,,"",""
 hl7.fhir.us.udap-security_1.0.0,124,https://hl7.org/fhir/us/udap-security/STU1/registration.html#modifying-and-cancelling-registrations,"If the Authorization Server returns the same client_id in the registration response for a modification request, it SHOULD also return a `200 OK` HTTP response code.",SHOULD,Server,,,,"",""
 hl7.fhir.us.udap-security_1.0.0,125,https://hl7.org/fhir/us/udap-security/STU1/registration.html#modifying-and-cancelling-registrations,"If the Authorization Server returns a new `client_id` in the registration response, the client application SHALL use only the new `client_id` in subsequent transactions with the Authorization Server.",SHOULD,Server,,,,"",""
 hl7.fhir.us.udap-security_1.0.0,131,https://hl7.org/fhir/us/udap-security/STU1/consumer.html#obtaining-an-authorization-code,Client applications .. MAY optionally support UDAP Tiered OAuth for User Authentication to allow for cross-organizational or third party user authentication as described in [Section 6](https://hl7.org/fhir/us/udap-security/STU1/user.html).,MAY,Server,,,,"",""
 hl7.fhir.us.udap-security_1.0.0,133,https://hl7.org/fhir/us/udap-security/STU1/consumer.html#obtaining-an-authorization-code,Servers SHALL handle and respond to authorization code requests as per [Section 4.1.2](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2) of RFC 6749.,SHALL,Server,,,,"1.3.01, 1.3.02","udap_security-udap_authorization_code_group-udap_authorization_code_authentication_group-udap_authorization_code_redirect, udap_security-udap_authorization_code_group-udap_authorization_code_authentication_group-udap_authorization_code_received"
 hl7.fhir.us.udap-security_1.0.0,134,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2,[When responding to an authorization request ]if the resource owner grants the access request… the `code` parameter [is] `REQUIRED`,SHALL,Server,,,,1.3.02,udap_security-udap_authorization_code_group-udap_authorization_code_authentication_group-udap_authorization_code_received
-hl7.fhir.us.udap-security_1.0.0,135,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2,[When responding to an authorization request i]f the resource owner grants the access request… the `code` parameter... MUST expire shortly after it is issued to mitigate the risk of leaks.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,137,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2,"If an authorization code is used more than once, the authorization server MUST deny the request",SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,135,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2,[When responding to an authorization request i]f the resource owner grants the access request… the `code` parameter... MUST expire shortly after it is issued to mitigate the risk of leaks.,SHALL,Server,,,,3.3.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authorization_code_token_requests_group-udap_security_auth_code_usage
+hl7.fhir.us.udap-security_1.0.0,137,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2,"If an authorization code is used more than once, the authorization server MUST deny the request",SHALL,Server,,,,3.3.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authorization_code_token_requests_group-udap_security_auth_code_usage
 hl7.fhir.us.udap-security_1.0.0,138,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2,"[When responding to an authorization request i]f the resource owner grants the access request… the `state` parameter [is] `REQUIRED`if the ""state"" parameter was present in the client authorization request",SHALL,Server,,,,1.3.02,udap_security-udap_authorization_code_group-udap_authorization_code_authentication_group-udap_authorization_code_received
-hl7.fhir.us.udap-security_1.0.0,146,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3,[When responding to an access token request t]he authorization server MUST: require client authentication for confidential clients or for any client that was issued client credentials (or with other authentication requirements),SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,147,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3,"[When responding to an access token request t]he authorization server MUST: ...authenticate the client if client authentication is included,",SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,146,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3,[When responding to an access token request t]he authorization server MUST: require client authentication for confidential clients or for any client that was issued client credentials (or with other authentication requirements),SHALL,Server,,,,3.3.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authorization_code_token_requests_group-udap_security_access_token_request_validation
+hl7.fhir.us.udap-security_1.0.0,147,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3,"[When responding to an access token request t]he authorization server MUST: ...authenticate the client if client authentication is included,",SHALL,Server,,,,3.3.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authorization_code_token_requests_group-udap_security_access_token_request_validation
 hl7.fhir.us.udap-security_1.0.0,148,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3,"[When responding to an access token request t]he authorization server MUST: … ensure that the authorization code was issued to the authenticated confidential client, or if the client is public, ensure that the code was issued to ""client_id"" in the request,",SHALL,Server,,,,1.3.03,udap_security-udap_authorization_code_group-udap_authorization_code_authentication_group-udap_authorization_code_token_exchange
-hl7.fhir.us.udap-security_1.0.0,149,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3,[When responding to an access token request t]he authorization server MUST: … verify that the authorization code is valid,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,150,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3,"[When responding to an access token request t]he authorization server MUST: … ensure that the ""redirect_uri"" parameter is present if the ""redirect_uri"" parameter was included in the initial authorization request as described in [Section 4.1.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1), and if included ensure that their values are identical.",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,172,https://hl7.org/fhir/us/udap-security/STU1/consumer.html#submitting-a-token-request,An Authorization Server receiving token requests containing Authentication Tokens... SHALL validate and respond to the request as per [Sections 6 and 7 of UDAP JWT-Based Client Authentication](https://www.udap.org/udap-jwt-client-auth.html).,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,173,https://www.udap.org/udap-jwt-client-auth.html,The AS validates the digital signature on the AnT [in the token request] using the public key extracted from cert1 in the x5c parameter of the JOSE header.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,174,https://www.udap.org/udap-jwt-client-auth.html,"If the signature cannot be validated [using the public key extracted from cert1 in the x5c parameter], the [token] request is denied.",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,176,https://www.udap.org/udap-jwt-client-auth.html,"If a trusted chain cannot be built and validated by the AS [for certificates in the x5c parameter of the JOSE header on AnTs in token requests], the request is denied.",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,182,https://www.udap.org/udap-jwt-client-auth.html,The AS validates any other parameters in the [token] request as per the requirements of the grant mechanism identified by the grant_type value.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,183,https://www.udap.org/udap-jwt-client-auth.html,"If a parameter is invalid or a required parameter is missing [on a token request], the request is denied",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,184,https://hl7.org/fhir/us/udap-security/STU1/consumer.html#submitting-a-token-request,"For all successful token requests, the Authorization Server SHALL issue access tokens with a lifetime no longer than 60 minutes.",SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,149,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3,[When responding to an access token request t]he authorization server MUST: … verify that the authorization code is valid,SHALL,Server,,,,3.3.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authorization_code_token_requests_group-udap_security_access_token_request_validation
+hl7.fhir.us.udap-security_1.0.0,150,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3,"[When responding to an access token request t]he authorization server MUST: … ensure that the ""redirect_uri"" parameter is present if the ""redirect_uri"" parameter was included in the initial authorization request as described in [Section 4.1.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1), and if included ensure that their values are identical.",SHALL,Server,,,,3.3.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authorization_code_token_requests_group-udap_security_access_token_request_validation
+hl7.fhir.us.udap-security_1.0.0,172,https://hl7.org/fhir/us/udap-security/STU1/consumer.html#submitting-a-token-request,An Authorization Server receiving token requests containing Authentication Tokens... SHALL validate and respond to the request as per [Sections 6 and 7 of UDAP JWT-Based Client Authentication](https://www.udap.org/udap-jwt-client-auth.html).,SHALL,Server,,,,3.9.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_jwt_security_group-udap_security_jwt_token_request_validation
+hl7.fhir.us.udap-security_1.0.0,173,https://www.udap.org/udap-jwt-client-auth.html,The AS validates the digital signature on the AnT [in the token request] using the public key extracted from cert1 in the x5c parameter of the JOSE header.,SHALL,Server,,,,3.9.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_jwt_security_group-udap_security_jwt_signature_validation
+hl7.fhir.us.udap-security_1.0.0,174,https://www.udap.org/udap-jwt-client-auth.html,"If the signature cannot be validated [using the public key extracted from cert1 in the x5c parameter], the [token] request is denied.",SHALL,Server,,,,3.6.03,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_error_handling_group-udap_security_deny_token_request
+hl7.fhir.us.udap-security_1.0.0,176,https://www.udap.org/udap-jwt-client-auth.html,"If a trusted chain cannot be built and validated by the AS [for certificates in the x5c parameter of the JOSE header on AnTs in token requests], the request is denied.",SHALL,Server,,,,"3.6.03, 3.9.05","udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_error_handling_group-udap_security_deny_token_request, udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_jwt_security_group-udap_security_jwt_certificate_chain_validation"
+hl7.fhir.us.udap-security_1.0.0,182,https://www.udap.org/udap-jwt-client-auth.html,The AS validates any other parameters in the [token] request as per the requirements of the grant mechanism identified by the grant_type value.,SHALL,Server,,,,3.9.04,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_jwt_security_group-udap_security_jwt_grant_parameter_validation
+hl7.fhir.us.udap-security_1.0.0,183,https://www.udap.org/udap-jwt-client-auth.html,"If a parameter is invalid or a required parameter is missing [on a token request], the request is denied",SHALL,Server,,,,3.6.03,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_error_handling_group-udap_security_deny_token_request
+hl7.fhir.us.udap-security_1.0.0,184,https://hl7.org/fhir/us/udap-security/STU1/consumer.html#submitting-a-token-request,"For all successful token requests, the Authorization Server SHALL issue access tokens with a lifetime no longer than 60 minutes.",SHALL,Server,,,,3.3.03,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authorization_code_token_requests_group-udap_security_access_token_lifetime
 hl7.fhir.us.udap-security_1.0.0,190,https://hl7.org/fhir/us/udap-security/STU1/b2b.html#obtaining-an-authorization-code,Servers SHALL handle and respond to authorization code requests as per [Section 4.1.2 of RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2).,SHALL,Server,,,,"1.3.01, 1.3.02","udap_security-udap_authorization_code_group-udap_authorization_code_authentication_group-udap_authorization_code_redirect, udap_security-udap_authorization_code_group-udap_authorization_code_authentication_group-udap_authorization_code_received"
-hl7.fhir.us.udap-security_1.0.0,229,https://hl7.org/fhir/us/udap-security/STU1/b2b.html#client-credentials-grant,An Authorization Server receiving token requests containing Authentication Tokens ... SHALL validate and respond to the request as per Sections 6 and 7 of UDAP JWT-Based Client Authentication.,SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,229,https://hl7.org/fhir/us/udap-security/STU1/b2b.html#client-credentials-grant,An Authorization Server receiving token requests containing Authentication Tokens ... SHALL validate and respond to the request as per Sections 6 and 7 of UDAP JWT-Based Client Authentication.,SHALL,Server,,,,3.9.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_jwt_security_group-udap_security_jwt_token_request_validation
 hl7.fhir.us.udap-security_1.0.0,230,https://hl7.org/fhir/us/udap-security/STU1/b2b.html#refresh-tokens,Authorization Servers MAY issue refresh tokens to B2B [and consumer-facing] client applications that use the authorization code grant type as per [Section 5 of RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749#section-5),MAY,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,238,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"Upon receiving an authorization request with a preferred IdP, the data holder first determines whether or not it trusts the IdP to perform user authentication, by retrieving and validating the IdP’s UDAP metadata from {baseURL}/.well-known/udap, as discussed in [Section 2.2](https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata)",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,239,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP is trusted and the data holder is not yet registered as a client with the IdP and the IdP supports UDAP Dynamic Registration, then the data holder SHALL register as a client with the IdP as per [Section 3](https://hl7.org/fhir/us/udap-security/STU1/registration.html#registration) of this guide.",SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,238,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"Upon receiving an authorization request with a preferred IdP, the data holder first determines whether or not it trusts the IdP to perform user authentication, by retrieving and validating the IdP’s UDAP metadata from {baseURL}/.well-known/udap, as discussed in [Section 2.2](https://hl7.org/fhir/us/udap-security/STU1/discovery.html#required-udap-metadata)",SHALL,Server,,,,3.10.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_identity_provider_interaction_group-udap_security_idp_metadata_validation
+hl7.fhir.us.udap-security_1.0.0,239,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP is trusted and the data holder is not yet registered as a client with the IdP and the IdP supports UDAP Dynamic Registration, then the data holder SHALL register as a client with the IdP as per [Section 3](https://hl7.org/fhir/us/udap-security/STU1/registration.html#registration) of this guide.",SHALL,Server,,,,3.10.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_identity_provider_interaction_group-udap_security_idp_dynamic_registration
 hl7.fhir.us.udap-security_1.0.0,240,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP is not trusted by the data holder, or if the data holder does not have and cannot obtain a client_id to use with the IdP, the data holder MAY reject the client app’s authorization request",MAY,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,241,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"[if the data holder rejects the request because of idP it SHALL return an error with the invalid_idp extension error code] as per [Section 4.1.2.1 of RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1), using the extension error code of invalid_idp.",SHALL,Server,true,,,"",""
-hl7.fhir.us.udap-security_1.0.0,242,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1,"If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server ... MUST NOT automatically redirect the user-agent to the invalid redirection URI.",SHALL NOT,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,241,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"[if the data holder rejects the request because of idP it SHALL return an error with the invalid_idp extension error code] as per [Section 4.1.2.1 of RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1), using the extension error code of invalid_idp.",SHALL,Server,true,,,3.6.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_error_handling_group-udap_security_invalid_idp_error
+hl7.fhir.us.udap-security_1.0.0,242,https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1,"If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server ... MUST NOT automatically redirect the user-agent to the invalid redirection URI.",SHALL NOT,Server,,,,3.6.05,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_error_handling_group-udap_security_invalid_redirection_uri
 hl7.fhir.us.udap-security_1.0.0,243,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP is not trusted by the data holder, or if the data holder does not have and cannot obtain a client_id to use with the IdP ... the data holder MAY attempt to authenticate the user with a different trusted IdP or its own IdP, and MAY interact with the user to determine a suitable alternative",MAY,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,245,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP is trusted by the data holder, and the data holder is registered as a client with the IdP, then the data holder, acting as an OIDC client, SHALL make an authentication request to the IdP’s authorization endpoint as per [Section 3.1.2.1 of OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) and Section 3.4 of [UDAP Tiered OAuth](https://www.udap.org/udap-user-auth-stu1.html).",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,246,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,Authorization Servers MUST support the use of the HTTP `GET` and `POST` methods defined in [RFC 7231](https://openid.net/specs/openid-connect-core-1_0.html#RFC7231) at the Authorization Endpoint.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,247,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,OpenID Connect [authentication] requests MUST contain the openid scope value.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,248,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,"[When constructing an OpenID Connect authentication request the] `response_type` parameter is REQUIRED. Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used. When using the Authorization Code Flow, this value is code.",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,249,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,[When constructing an OpenID Connect authentication request the] `client_id` [parameter is] REQUIRED [and SHALL be a] Client Identifier valid at the Authorization Server.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,250,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,[When constructing an OpenID Connect authentication request the] `redirect_uri` [parameter is] REQUIRED [and SHALL be a] Redirection URI to which the response will be sent.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,251,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,"[When constructing an OpenID Connect authentication request] The [`redirect_uri`] URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in [Section 6.2.1 of [RFC3986]](https://openid.net/specs/openid-connect-core-1_0.html#RFC3986) (Simple String Comparison).",SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,245,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP is trusted by the data holder, and the data holder is registered as a client with the IdP, then the data holder, acting as an OIDC client, SHALL make an authentication request to the IdP’s authorization endpoint as per [Section 3.1.2.1 of OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) and Section 3.4 of [UDAP Tiered OAuth](https://www.udap.org/udap-user-auth-stu1.html).",SHALL,Server,,,,3.10.03,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_identity_provider_interaction_group-udap_security_idp_authentication_request
+hl7.fhir.us.udap-security_1.0.0,246,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,Authorization Servers MUST support the use of the HTTP `GET` and `POST` methods defined in [RFC 7231](https://openid.net/specs/openid-connect-core-1_0.html#RFC7231) at the Authorization Endpoint.,SHALL,Server,,,,3.4.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_construction
+hl7.fhir.us.udap-security_1.0.0,247,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,OpenID Connect [authentication] requests MUST contain the openid scope value.,SHALL,Server,,,,3.4.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_construction
+hl7.fhir.us.udap-security_1.0.0,248,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,"[When constructing an OpenID Connect authentication request the] `response_type` parameter is REQUIRED. Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used. When using the Authorization Code Flow, this value is code.",SHALL,Server,,,,3.4.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_construction
+hl7.fhir.us.udap-security_1.0.0,249,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,[When constructing an OpenID Connect authentication request the] `client_id` [parameter is] REQUIRED [and SHALL be a] Client Identifier valid at the Authorization Server.,SHALL,Server,,,,3.4.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_construction
+hl7.fhir.us.udap-security_1.0.0,250,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,[When constructing an OpenID Connect authentication request the] `redirect_uri` [parameter is] REQUIRED [and SHALL be a] Redirection URI to which the response will be sent.,SHALL,Server,,,,3.4.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_construction
+hl7.fhir.us.udap-security_1.0.0,251,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest,"[When constructing an OpenID Connect authentication request] The [`redirect_uri`] URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in [Section 6.2.1 of [RFC3986]](https://openid.net/specs/openid-connect-core-1_0.html#RFC3986) (Simple String Comparison).",SHALL,Server,,,,3.4.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_construction
 hl7.fhir.us.udap-security_1.0.0,252,https://www.udap.org/udap-user-auth-stu1.html,"[When UDAP Tiered OAuth for User Authentication  is being requested] If... [the “openid” and “udap”] scope is omitted, the behavior of the IdP is entirely unspecified and the IdP SHOULD NOT proceed with the UDAP Tiered OAuth for User Authentication  workflow.",SHOULD NOT,server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,253,https://www.udap.org/udap-user-auth-stu1.html,The Resource Holder MUST use the authorization code flow when redirecting the user to the IdP’s authorization endpoint,SHALL,server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,254,https://www.udap.org/udap-user-auth-stu1.html,The Resource Holder MUST generate its own random value for the state parameter,SHALL,server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,255,https://www.udap.org/udap-user-auth-stu1.html,The Resource Holder MUST NOT reuse the [state] value provided by the Client App in Step 2.,SHALL NOT,server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,258,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,The Authorization Server MUST validate all the OAuth 2.0 [authentication request] parameters according to the OAuth 2.0 specification.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,259,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"the Authorization Server MUST ...Verify that a `scope` parameter is present and contains the `openid` scope value [on an authentication request]. (If no `openid` scope value is present, the request may still be a valid OAuth 2.0 request but is not an OpenID Connect request.)",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,260,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,The Authorization Server MUST verify that all the REQUIRED [authentication request] parameters are present and their usage conforms to this specification.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,261,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"If the sub (subject) Claim is requested [on an authentication request] with a specific value for the ID Token, the Authorization Server MUST only send a positive response if the End-User identified by that sub value has an active session with the Authorization Server or has been Authenticated as a result of the request.",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,262,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"The Authorization Server MUST NOT reply [to an authentication request] with an ID Token or Access Token for a different user, even if they have an active session with the Authorization Server.",SHALL NOT,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,263,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"When an id_token_hint is present [on an authentication request], the OP MUST validate that it was the issuer of the ID Token.",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,264,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"[When validating authentication requests received] If the Authorization Server encounters any error, it MUST return an error response, per [Section 3.1.2.6](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation)",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,265,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,he Authorization Server MUST attempt to Authenticate the End-User [for an authentication request when] … The End-User is not already Authenticated.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,266,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"The Authorization Server MUST attempt to Authenticate the End-User [for an authentication request when] … The Authentication Request contains the prompt parameter with the value login. In this case, the Authorization Server MUST reauthenticate the End-User even if the End-User is already authenticated.",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,267,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"The Authorization Server MUST NOT interact with the End-User [on an authentication request when] the  Authentication Request contains the prompt parameter with the value none. In this case, the Authorization Server MUST return an error if an End-User is not already Authenticated or could not be silently Authenticated.",SHALL NOT,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,268,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"In this case, [when the Authentication Request contains the prompt parameter with the value none] the Authorization Server MUST return an error if an End-User is not already Authenticated or could not be silently Authenticated.",SHALL NOT,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,269,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"When interacting with the End-User [for an authentication request], the Authorization Server MUST employ appropriate measures against Cross-Site Request Forgery and Clickjacking as, described in [Sections 10.12 and 10.13 of OAuth 2.0](https://openid.net/specs/openid-connect-core-1_0.html#RFC6749)  [RFC6749].",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,270,https://www.udap.org/udap-user-auth-stu1.html,[When the IdP interacts with the user to authenticate the user] The Resource Holder MUST validate that the value of the state parameter in the query string matches the value generated in Step 3.4.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,271,https://www.udap.org/udap-user-auth-stu1.html,"[When the IdP interacts with the user to authenticate the user] If [the value of the state parameter in the query string ] does NOT match, the Resource Holder MUST terminate this workflow by redirecting the user’s browser to the Client App’s redirection URI with an error code of “server_error” as per standard OAuth 2.0 error flow.",SHALL NOT,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,272,https://www.udap.org/udap-user-auth-stu1.html,"If the Resource Holder receives ... an error response from the IdP [for an authentication request], the Resource Holder MUST first validate the value of the state parameter as described in Step 4.1",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,273,https://www.udap.org/udap-user-auth-stu1.html,"If the state value is valid [on an error response for an authentication request], the Resource Holder MUST terminate this workflow by redirecting the user’s browser to the Client App’s redirection URI with an error code of “access_denied” as per standard OAuth 2.0 error flow,",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,278,https://datatracker.ietf.org/doc/html/rfc6749#section-10.12,The authorization server MUST implement CSRF protection for its authorization endpoint and ensure that a malicious client cannot obtain authorization without the awareness and explicit consent of the resource owner.,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,279,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP returns a successful authentication response with valid state parameter value and an authorization code, the data holder SHALL exchange the code for an access token and ID Token by making a request to the IdP’s token endpoint as per [Section 3.1.3.1 of OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest) and Section 4.3 of [UDAP Tiered OAuth](https://www.udap.org/udap-user-auth-stu1.html).",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,282,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP returns an ID Token, the data holder SHALL then validate the ID Token as per Section [3.1.3.5 of OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation).",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,283,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,"The Client MUST validate the Token Response … Follow[ing] the validation rules in RFC 6749, especially those in [Sections 5.1 and 10.12](https://datatracker.ietf.org/doc/rfc6749/).",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,284,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,[When constructing an an access token response] the `access_token` parameter [is] `REUIRED`… [and] added to the entity-body of the HTTP response with a 200 (OK) status code,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,285,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,[When constructing an an access token response] the `token_type` parameter [is] `REUIRED`… [and] added to the entity-body of the HTTP response with a 200 (OK) status code,SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,287,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,The authorization server MUST NOT issue client passwords or other client credentials to native application or user-agent-based application clients for the purpose of client authentication.,SHALL NOT,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,288,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,"The authorization server must consider the security implications of interacting with unauthenticated clients and take measures to limit the potential exposure of other credentials (e.g., refresh tokens) issued to such clients.",SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,253,https://www.udap.org/udap-user-auth-stu1.html,The Resource Holder MUST use the authorization code flow when redirecting the user to the IdP’s authorization endpoint,SHALL,server,,,,3.3.04,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authorization_code_token_requests_group-udap_security_authorization_code_flow
+hl7.fhir.us.udap-security_1.0.0,254,https://www.udap.org/udap-user-auth-stu1.html,The Resource Holder MUST generate its own random value for the state parameter,SHALL,server,,,,3.7.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_security_measures_group-udap_security_state_parameter_management
+hl7.fhir.us.udap-security_1.0.0,255,https://www.udap.org/udap-user-auth-stu1.html,The Resource Holder MUST NOT reuse the [state] value provided by the Client App in Step 2.,SHALL NOT,server,,,,3.7.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_security_measures_group-udap_security_state_parameter_management
+hl7.fhir.us.udap-security_1.0.0,258,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,The Authorization Server MUST validate all the OAuth 2.0 [authentication request] parameters according to the OAuth 2.0 specification.,SHALL,Server,,,,3.4.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_validation
+hl7.fhir.us.udap-security_1.0.0,259,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"the Authorization Server MUST ...Verify that a `scope` parameter is present and contains the `openid` scope value [on an authentication request]. (If no `openid` scope value is present, the request may still be a valid OAuth 2.0 request but is not an OpenID Connect request.)",SHALL,Server,,,,"3.4.01, 3.4.02","udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_construction, udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_validation"
+hl7.fhir.us.udap-security_1.0.0,260,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,The Authorization Server MUST verify that all the REQUIRED [authentication request] parameters are present and their usage conforms to this specification.,SHALL,Server,,,,3.4.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_validation
+hl7.fhir.us.udap-security_1.0.0,261,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"If the sub (subject) Claim is requested [on an authentication request] with a specific value for the ID Token, the Authorization Server MUST only send a positive response if the End-User identified by that sub value has an active session with the Authorization Server or has been Authenticated as a result of the request.",SHALL,Server,,,,3.4.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_validation
+hl7.fhir.us.udap-security_1.0.0,262,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"The Authorization Server MUST NOT reply [to an authentication request] with an ID Token or Access Token for a different user, even if they have an active session with the Authorization Server.",SHALL NOT,Server,,,,3.4.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_validation
+hl7.fhir.us.udap-security_1.0.0,263,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"When an id_token_hint is present [on an authentication request], the OP MUST validate that it was the issuer of the ID Token.",SHALL,Server,,,,3.4.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_validation
+hl7.fhir.us.udap-security_1.0.0,264,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"[When validating authentication requests received] If the Authorization Server encounters any error, it MUST return an error response, per [Section 3.1.2.6](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation)",SHALL,Server,,,,3.4.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_validation
+hl7.fhir.us.udap-security_1.0.0,265,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,he Authorization Server MUST attempt to Authenticate the End-User [for an authentication request when] … The End-User is not already Authenticated.,SHALL,Server,,,,3.4.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_validation
+hl7.fhir.us.udap-security_1.0.0,266,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"The Authorization Server MUST attempt to Authenticate the End-User [for an authentication request when] … The Authentication Request contains the prompt parameter with the value login. In this case, the Authorization Server MUST reauthenticate the End-User even if the End-User is already authenticated.",SHALL,Server,,,,3.4.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_validation
+hl7.fhir.us.udap-security_1.0.0,267,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"The Authorization Server MUST NOT interact with the End-User [on an authentication request when] the  Authentication Request contains the prompt parameter with the value none. In this case, the Authorization Server MUST return an error if an End-User is not already Authenticated or could not be silently Authenticated.",SHALL NOT,Server,,,,"3.4.02, 3.6.04","udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_validation, udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_error_handling_group-udap_security_prompt_none_error"
+hl7.fhir.us.udap-security_1.0.0,268,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"In this case, [when the Authentication Request contains the prompt parameter with the value none] the Authorization Server MUST return an error if an End-User is not already Authenticated or could not be silently Authenticated.",SHALL NOT,Server,,,,3.6.04,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_error_handling_group-udap_security_prompt_none_error
+hl7.fhir.us.udap-security_1.0.0,269,https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation,"When interacting with the End-User [for an authentication request], the Authorization Server MUST employ appropriate measures against Cross-Site Request Forgery and Clickjacking as, described in [Sections 10.12 and 10.13 of OAuth 2.0](https://openid.net/specs/openid-connect-core-1_0.html#RFC6749)  [RFC6749].",SHALL,Server,,,,"3.4.02, 3.7.01","udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_authentication_requests_group-oidc_auth_request_validation, udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_security_measures_group-udap_security_csrf_protection"
+hl7.fhir.us.udap-security_1.0.0,270,https://www.udap.org/udap-user-auth-stu1.html,[When the IdP interacts with the user to authenticate the user] The Resource Holder MUST validate that the value of the state parameter in the query string matches the value generated in Step 3.4.,SHALL,Server,,,,3.7.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_security_measures_group-udap_security_state_parameter_management
+hl7.fhir.us.udap-security_1.0.0,271,https://www.udap.org/udap-user-auth-stu1.html,"[When the IdP interacts with the user to authenticate the user] If [the value of the state parameter in the query string ] does NOT match, the Resource Holder MUST terminate this workflow by redirecting the user’s browser to the Client App’s redirection URI with an error code of “server_error” as per standard OAuth 2.0 error flow.",SHALL NOT,Server,,,,3.6.06,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_error_handling_group-udap_security_state_mismatch_error
+hl7.fhir.us.udap-security_1.0.0,272,https://www.udap.org/udap-user-auth-stu1.html,"If the Resource Holder receives ... an error response from the IdP [for an authentication request], the Resource Holder MUST first validate the value of the state parameter as described in Step 4.1",SHALL,Server,,,,3.7.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_security_measures_group-udap_security_state_parameter_management
+hl7.fhir.us.udap-security_1.0.0,273,https://www.udap.org/udap-user-auth-stu1.html,"If the state value is valid [on an error response for an authentication request], the Resource Holder MUST terminate this workflow by redirecting the user’s browser to the Client App’s redirection URI with an error code of “access_denied” as per standard OAuth 2.0 error flow,",SHALL,Server,,,,3.6.08,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_error_handling_group-udap_security_valid_state_error_response
+hl7.fhir.us.udap-security_1.0.0,278,https://datatracker.ietf.org/doc/html/rfc6749#section-10.12,The authorization server MUST implement CSRF protection for its authorization endpoint and ensure that a malicious client cannot obtain authorization without the awareness and explicit consent of the resource owner.,SHALL,Server,,,,3.7.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_security_measures_group-udap_security_csrf_protection
+hl7.fhir.us.udap-security_1.0.0,279,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP returns a successful authentication response with valid state parameter value and an authorization code, the data holder SHALL exchange the code for an access token and ID Token by making a request to the IdP’s token endpoint as per [Section 3.1.3.1 of OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest) and Section 4.3 of [UDAP Tiered OAuth](https://www.udap.org/udap-user-auth-stu1.html).",SHALL,Server,,,,3.10.04,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_identity_provider_interaction_group-udap_security_idp_token_exchange
+hl7.fhir.us.udap-security_1.0.0,282,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP returns an ID Token, the data holder SHALL then validate the ID Token as per Section [3.1.3.5 of OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation).",SHALL,Server,,,,3.5.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_id_token_access_token_validation_group-udap_security_id_token_validation
+hl7.fhir.us.udap-security_1.0.0,283,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,"The Client MUST validate the Token Response … Follow[ing] the validation rules in RFC 6749, especially those in [Sections 5.1 and 10.12](https://datatracker.ietf.org/doc/rfc6749/).",SHALL,Server,,,,"3.5.02, 3.5.03","udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_id_token_access_token_validation_group-udap_security_access_token_validation, udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_id_token_access_token_validation_group-udap_security_token_response_validation"
+hl7.fhir.us.udap-security_1.0.0,284,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,[When constructing an an access token response] the `access_token` parameter [is] `REUIRED`… [and] added to the entity-body of the HTTP response with a 200 (OK) status code,SHALL,Server,,,,3.5.03,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_id_token_access_token_validation_group-udap_security_token_response_validation
+hl7.fhir.us.udap-security_1.0.0,285,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,[When constructing an an access token response] the `token_type` parameter [is] `REUIRED`… [and] added to the entity-body of the HTTP response with a 200 (OK) status code,SHALL,Server,,,,3.5.03,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_id_token_access_token_validation_group-udap_security_token_response_validation
+hl7.fhir.us.udap-security_1.0.0,287,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,The authorization server MUST NOT issue client passwords or other client credentials to native application or user-agent-based application clients for the purpose of client authentication.,SHALL NOT,Server,,,,3.8.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_client_authentication_group-udap_security_no_client_credentials_native_apps
+hl7.fhir.us.udap-security_1.0.0,288,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,"The authorization server must consider the security implications of interacting with unauthenticated clients and take measures to limit the potential exposure of other credentials (e.g., refresh tokens) issued to such clients.",SHALL,Server,,,,3.7.03,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_security_measures_group-udap_security_unauthenticated_clients
 hl7.fhir.us.udap-security_1.0.0,289,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,"The Client MUST validate the Token Response ...
 
-Follow[ing] the ID Token validation rules in Section [3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).",SHALL,Server,,,,"",""
+Follow[ing] the ID Token validation rules in Section [3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).",SHALL,Server,,,,3.5.01,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_id_token_access_token_validation_group-udap_security_id_token_validation
 hl7.fhir.us.udap-security_1.0.0,290,https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation,"The Client MUST validate the Token Response ...
 
-Follow[ing] the Access Token validation rules in Section [3.1.3.8](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowTokenValidation)",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,291,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP does not return an ID Token, or the ID Token cannot be successfully validated, or an error response is retured by the IdP, the data holder MAY return an `invalid_idp` error code to the client app or attempt an alternate user authentication",SHALL,Server,,,,"",""
+Follow[ing] the Access Token validation rules in Section [3.1.3.8](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowTokenValidation)",SHALL,Server,,,,3.5.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_id_token_access_token_validation_group-udap_security_access_token_validation
+hl7.fhir.us.udap-security_1.0.0,291,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-authentication-request-to-idp,"If the IdP does not return an ID Token, or the ID Token cannot be successfully validated, or an error response is retured by the IdP, the data holder MAY return an `invalid_idp` error code to the client app or attempt an alternate user authentication",SHALL,Server,,,,3.6.02,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_error_handling_group-udap_security_invalid_id_token_error
 hl7.fhir.us.udap-security_1.0.0,292,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-interaction-with-user-after-authentication,"When an ID Token has been returned and validated, the data holder SHOULD use the ID Token to attempt to match the authenticated user to a user or role in its own system, as appropriate for the resources requested.",SHOULD,Server,,,,"",""
 hl7.fhir.us.udap-security_1.0.0,293,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-interaction-with-user-after-authentication,"the data holder can attempt to map the pair (`iss`,`sub`) to a known users in the data holder’s system.",MAY,Server,,,,"",""
 hl7.fhir.us.udap-security_1.0.0,294,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-interaction-with-user-after-authentication,"If the data holder has previously performed this mapping or has otherwise bound the pair (`iss`,`sub`) to a local user or role, it MAY rely on this previous mapping for subsequent authentications",MAY,Server,,,,"",""
 hl7.fhir.us.udap-security_1.0.0,295,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-interaction-with-user-after-authentication,the data holder MAY interact with the user following the redirection from the IdP back to the data holder’s redirection URI to increase confidence in the [role] resolution process.,MAY,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,296,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-interaction-with-user-after-authentication,"If the data holder is unable to resolve the authenticated user to a local user or role, as appropriate for the resources requested, it SHALL return an `access_denied` error response to the client app’s authorization request and terminate the workflow.",SHALL,Server,,,,"",""
-hl7.fhir.us.udap-security_1.0.0,297,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-interaction-with-user-after-authentication,"If the data holder successfully maps the authenticated user to a user or role in its own system, as appropriate for the resources requested, it SHALL also obtain authorization from the user for the scopes requested by the client app, if such authorization is required, as per Section [4.5 of UDAP Tiered OAuth](https://www.udap.org/udap-user-auth-stu1.html), returning to the workflow defined in [Section 4.1](https://hl7.org/fhir/us/udap-security/STU1/consumer.html#obtaining-an-authorization-code) or [Section 5.1](https://hl7.org/fhir/us/udap-security/STU1/b2b.html#obtaining-an-authorization-code) of this guide, for consumer-facing or B2B apps, respectively.",SHALL,Server,,,,"",""
+hl7.fhir.us.udap-security_1.0.0,296,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-interaction-with-user-after-authentication,"If the data holder is unable to resolve the authenticated user to a local user or role, as appropriate for the resources requested, it SHALL return an `access_denied` error response to the client app’s authorization request and terminate the workflow.",SHALL,Server,,,,3.6.07,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_error_handling_group-udap_security_unauthenticated_user_error
+hl7.fhir.us.udap-security_1.0.0,297,https://hl7.org/fhir/us/udap-security/STU1/user.html#data-holder-interaction-with-user-after-authentication,"If the data holder successfully maps the authenticated user to a user or role in its own system, as appropriate for the resources requested, it SHALL also obtain authorization from the user for the scopes requested by the client app, if such authorization is required, as per Section [4.5 of UDAP Tiered OAuth](https://www.udap.org/udap-user-auth-stu1.html), returning to the workflow defined in [Section 4.1](https://hl7.org/fhir/us/udap-security/STU1/consumer.html#obtaining-an-authorization-code) or [Section 5.1](https://hl7.org/fhir/us/udap-security/STU1/b2b.html#obtaining-an-authorization-code) of this guide, for consumer-facing or B2B apps, respectively.",SHALL,Server,,,,3.7.04,udap_security-udap_server_v100_visual_inspection_and_attestation-udap_server_v100_security_measures_group-udap_security_user_authorization

data/lib/udap_security_test_kit/version.rb

@@ -1,4 +1,4 @@
 module UDAPSecurityTestKit
-  VERSION = '0.11.6'.freeze
-  LAST_UPDATED = '2025-06-26'.freeze
+  VERSION = '0.12.0'.freeze
+  LAST_UPDATED = '2025-07-21'.freeze
 end

data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/b2b_authorization_extension_object_test.rb

@@ -0,0 +1,77 @@
+module UDAPSecurityTestKit
+  class B2BAuthorizationExtensionObjectAttestationTest < Inferno::Test
+    title 'Complies with requirements for the B2B Flow and Authorization Extension Object'
+    id :udap_security_b2b_authorization_extension_object
+    description %(
+      Client application complies with requirements for the B2B Flow and Authorization Extension Object and:
+      - Includes `subject_name` parameter if it is known for human or non-human requestors.
+      - Includes `subject_id` parameter for human requestors when the `subject_name` parameter is present.
+      - Uses the National Provider Identifier (NPI) as the value for `subject_id` for human requestors in the US Realm.
+      - Ensures that the `consent_reference` parameter includes URLs that are resolvable by the receiving party.
+      - Omits `consent_reference` if `consent_policy` is not present.
+      - Ensures that the Requestor’s User, if applicable, is using the app only as authorized by the Requestor.
+      - Omits the `extensions` claim for client apps using the `authorization_code` flow.
+      - Includes the `subject_role` value if known for human requestors when the `subject_name` parameter is
+        present, and for US Realm, uses values/formats constrained by trust communities (preferably from the
+        NUCC Provider Taxonomy Code Set).
+      - Includes the `organization_id` value, using a URI scheme defined by the trust community.
+    )
+    verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@187',
+                          'hl7.fhir.us.udap-security_1.0.0@199',
+                          'hl7.fhir.us.udap-security_1.0.0@203',
+                          'hl7.fhir.us.udap-security_1.0.0@204',
+                          'hl7.fhir.us.udap-security_1.0.0@205',
+                          'hl7.fhir.us.udap-security_1.0.0@206',
+                          'hl7.fhir.us.udap-security_1.0.0@207',
+                          'hl7.fhir.us.udap-security_1.0.0@208',
+                          'hl7.fhir.us.udap-security_1.0.0@213',
+                          'hl7.fhir.us.udap-security_1.0.0@219',
+                          'hl7.fhir.us.udap-security_1.0.0@220',
+                          'hl7.fhir.us.udap-security_1.0.0@221'
+
+    input :b2b_authorization_extension_object_compliance,
+          title: 'Complies with requirements for the B2B Flow and Authorization Extension Object',
+          description: %(
+            I attest that the client application complies with requirements for the B2B Flow and Authorization
+            Extension Object and:
+            - Includes `subject_name` parameter if it is known for human or non-human requestors.
+            - Includes `subject_id` parameter for human requestors when the `subject_name` parameter is present.
+            - Uses the National Provider Identifier (NPI) as the value for `subject_id` for human requestors in the
+              US Realm.
+            - Ensures that the `consent_reference` parameter includes URLs that are resolvable by the receiving party.
+            - Omits `consent_reference` if `consent_policy` is not present.
+            - Ensures that the Requestor’s User, if applicable, is using the app only as authorized by the Requestor.
+            - Omits the `extensions` claim for client apps using the `authorization_code` flow.
+            - Includes the `subject_role` value if known for human requestors when the `subject_name` parameter is
+              present, and for US Realm, uses values/formats constrained by trust communities (preferably from the
+              NUCC Provider Taxonomy Code Set).
+            - Includes the `organization_id` value, using a URI scheme defined by the trust community.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :b2b_authorization_extension_object_compliance_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
+    run do
+      assert b2b_authorization_extension_object_compliance == 'true',
+             'Client application did not comply with requirements for the B2B Authorization Extension Object.'
+      if b2b_authorization_extension_object_compliance_note.present?
+        pass b2b_authorization_extension_object_compliance_note
+      end
+    end
+  end
+end

data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/client_authorization_code_usage_test.rb

@@ -0,0 +1,47 @@
+module UDAPSecurityTestKit
+  class ClientAuthorizationCodeUsageAttestationTest < Inferno::Test
+    title 'Uses authorization code correctly'
+    id :udap_security_client_auth_code_usage
+    description %(
+      Client application uses the authorization code correctly by:
+      - Ensuring the authorization code is not used more than once.
+      - Requesting an authorization code as per [Section 4.1.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1)
+        of RFC 6749.
+    )
+    verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@136',
+                          'hl7.fhir.us.udap-security_1.0.0@188'
+
+    input :authorization_code_usage_correctly,
+          title: 'Uses authorization code correctly',
+          description: %(
+            I attest that the client application uses the authorization code correctly by:
+            - Ensuring the authorization code is not used more than once.
+            - Requesting an authorization code as per [Section 4.1.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1)
+              of RFC 6749.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :authorization_code_usage_correctly_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
+    run do
+      assert authorization_code_usage_correctly == 'true',
+             'Client application did not demonstrate correct usage of the authorization code.'
+      pass authorization_code_usage_correctly_note if authorization_code_usage_correctly_note.present?
+    end
+  end
+end

data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/client_security_csrf_protection_test.rb

@@ -0,0 +1,50 @@
+module UDAPSecurityTestKit
+  class ClientSecurityAndCSRFProtectionAttestationTest < Inferno::Test
+    title 'Complies with Client Security and CSRF Protection'
+    id :udap_security_client_security_csrf_protection
+    description %(
+      Client applications complies with the requirements for Client Security and CSRF Protection:
+      - Implements CSRF protection for its redirection URI.
+      - Uses a binding value for CSRF protection that contains a non-guessable value.
+      - Ensures the user-agent's authenticated state is accessible only to the client and user-agent, protected by
+        the same-origin policy.
+    )
+    verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@275',
+                          'hl7.fhir.us.udap-security_1.0.0@276',
+                          'hl7.fhir.us.udap-security_1.0.0@277'
+
+    input :csrf_protection_implementation,
+          title: 'Complies with the requirements for Client Security and CSRF Protection',
+          description: %(
+            I attest that the client application complies with the requirements for Client Security and CSRF Protection:
+            - Implements CSRF protection for its redirection URI.
+            - Uses a binding value for CSRF protection that contains a non-guessable value.
+            - Ensures the user-agent's authenticated state is accessible only to the client and user-agent, protected by
+              the same-origin policy.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+    input :csrf_protection_implementation_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
+    run do
+      assert csrf_protection_implementation == 'true',
+             'Client application did not comply with the requirements for Client Security and CSRF Protection.'
+      pass csrf_protection_implementation_note if csrf_protection_implementation_note.present?
+    end
+  end
+end

data/lib/udap_security_test_kit/visual_inspection_and_attestation/client/cryptographic_algorithms_test.rb

@@ -0,0 +1,44 @@
+module UDAPSecurityTestKit
+  class CryptographicAlgorithmsAndSecurityProtocolsAttestationTest < Inferno::Test
+    title 'supports the RS256 signature algorithm'
+    id :udap_security_crypto_algorithms_and_protocols
+    description %(
+      Client application supports the RS256 signature algorithm as defined in as defined in
+      [RFC 7518](https://datatracker.ietf.org/doc/html/rfc7518#section-3.1) for UDAP workflows.
+    )
+    verifies_requirements 'hl7.fhir.us.udap-security_1.0.0@4'
+
+    input :crypto_algorithms_and_protocols_compliance,
+          title: 'Supports the RS256 signature algorithm',
+          description: %(
+            I attest that the client application supports the RS256 signature algorithm as defined in as defined in
+            [RFC 7518](https://datatracker.ietf.org/doc/html/rfc7518#section-3.1) for UDAP workflows.
+          ),
+          type: 'radio',
+          default: 'false',
+          options: {
+            list_options: [
+              {
+                label: 'Yes',
+                value: 'true'
+              },
+              {
+                label: 'No',
+                value: 'false'
+              }
+            ]
+          }
+
+    input :crypto_algorithms_and_protocols_compliance_note,
+          title: 'Notes, if applicable:',
+          type: 'textarea',
+          optional: true
+
+    run do
+      assert crypto_algorithms_and_protocols_compliance == 'true',
+             'Client application did not comply with cryptographic algorithms and security protocols requirements
+              (RS256 support).'
+      pass crypto_algorithms_and_protocols_compliance_note if crypto_algorithms_and_protocols_compliance_note.present?
+    end
+  end
+end