udap_security_test_kit 0.9.2 → 0.10.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. checksums.yaml +4 -4
  2. data/lib/udap_security_test_kit/authorization_code_authentication_group.rb +17 -3
  3. data/lib/udap_security_test_kit/authorization_code_group.rb +15 -15
  4. data/lib/udap_security_test_kit/authorization_code_redirect_test.rb +6 -2
  5. data/lib/udap_security_test_kit/authorization_code_token_exchange_test.rb +9 -10
  6. data/lib/udap_security_test_kit/client_credentials_authentication_group.rb +17 -3
  7. data/lib/udap_security_test_kit/client_credentials_group.rb +12 -12
  8. data/lib/udap_security_test_kit/client_credentials_token_exchange_test.rb +9 -8
  9. data/lib/udap_security_test_kit/redirect_uri.rb +3 -0
  10. data/lib/udap_security_test_kit/registration_success_contents_test.rb +27 -9
  11. data/lib/udap_security_test_kit/software_statement_builder.rb +2 -1
  12. data/lib/udap_security_test_kit/token_exchange_response_body_test.rb +10 -0
  13. data/lib/udap_security_test_kit/version.rb +1 -1
  14. data/lib/udap_security_test_kit.rb +10 -1
  15. metadata +6 -5
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 6434b6856c5921b1846d46d1e705cda99c91f8c9d1cc3e344f8c119fb62c4a22
4
- data.tar.gz: f54f00f46ba5f61b5e3f8edfb11b87bd1fef67b82a3b91e6f96283ee6e224d51
3
+ metadata.gz: 43c8eabf008e3dd76265b3e455a80e27f2af665548319c7b3f8c565daf71a3d4
4
+ data.tar.gz: ed6ed1097c0fc02baf51392df43875ac4974dbdb49e494b5eee0595fd33dcf0e
5
5
  SHA512:
6
- metadata.gz: 06e9e1a1806f44417881c60b44d0b2c8e85b8cb3bf1b260ed1e1785971572548944dc02c815ccf7978744303792fd28819c988b71f1d4e4cc43d6a1a2d82a982
7
- data.tar.gz: 971aa818c9122d76204a103cafb53faec868e0cb8f8ac36bb22059ffa195238262bb5845300faaa3ba6c762e1a0de0f6ba62b27a4cf41e2950c686f9878d4657
6
+ metadata.gz: 3433cf5e7929b434de4bff0b999b455c9dd0d9fb407d0574b592ce3921ec7037cd0cf9be598319b6fdeca648d887033d842c20845ff09de0e8046ed533e4b9c8
7
+ data.tar.gz: 6437f00f2ceb182e454a41d5555284bb516d763cba8c2684d39dc7dcb0f7252c8a50b3f70f3c2753df75a98e72cb7a348199d42a4e6d24c994abbbb61c39bb65
data/lib/udap_security_test_kit/authorization_code_authentication_group.rb CHANGED
@@ -20,7 +20,7 @@ module UDAPSecurityTestKit
20
20
  config: {
21
21
  requests: {
22
22
  token_exchange: {
23
- name: :authorization_code_token_exchange
23
+ name: :udap_auth_code_flow_token_exchange
24
24
  }
25
25
  }
26
26
  }
@@ -28,7 +28,21 @@ module UDAPSecurityTestKit
28
28
  config: {
29
29
  inputs: {
30
30
  token_response_body: {
31
- name: :authorization_code_token_response_body
31
+ name: :udap_auth_code_flow_token_exchange_response_body
32
+ }
33
+ },
34
+ outputs: {
35
+ udap_access_token: {
36
+ name: :udap_auth_code_flow_access_token
37
+ },
38
+ udap_expires_in: {
39
+ name: :udap_auth_code_flow_expires_in
40
+ },
41
+ udap_received_scopes: {
42
+ name: :udap_auth_code_flow_received_scopes
43
+ },
44
+ udap_refresh_token: {
45
+ name: :udap_auth_code_flow_refresh_token
32
46
  }
33
47
  }
34
48
  }
@@ -36,7 +50,7 @@ module UDAPSecurityTestKit
36
50
  config: {
37
51
  requests: {
38
52
  token_exchange: {
39
- name: :authorization_code_token_exchange
53
+ name: :udap_auth_code_flow_token_exchange
40
54
  }
41
55
  }
42
56
  }
data/lib/udap_security_test_kit/authorization_code_group.rb CHANGED
@@ -45,24 +45,24 @@ module UDAPSecurityTestKit
45
45
  config: {
46
46
  inputs: {
47
47
  udap_registration_grant_type: {
48
- name: :reg_grant_type_auth_code,
48
+ name: :udap_auth_code_flow_registration_grant_type,
49
49
  default: 'authorization_code',
50
50
  locked: true
51
51
  },
52
52
  udap_client_cert_pem: {
53
- name: :udap_client_cert_pem_auth_code_flow,
53
+ name: :udap_auth_code_flow_client_cert_pem,
54
54
  title: 'Authorization Code Client Certificate(s) (PEM Format)'
55
55
  },
56
56
  udap_client_private_key_pem: {
57
- name: :udap_client_private_key_auth_code_flow,
57
+ name: :udap_auth_code_flow_client_private_key,
58
58
  title: 'Authorization Code Client Private Key (PEM Format)'
59
59
  },
60
60
  udap_cert_iss: {
61
- name: :udap_cert_iss_auth_code_flow,
61
+ name: :udap_auth_code_flow_cert_iss,
62
62
  title: 'Authorization Code JWT Issuer (iss) Claim'
63
63
  },
64
64
  udap_registration_requested_scope: {
65
- name: :udap_registration_scope_auth_code_flow,
65
+ name: :udap_auth_code_flow_registration_scope,
66
66
  title: 'Authorization Code Registration Requested Scope(s)',
67
67
  description: %(
68
68
  String containing a space delimited list of scopes requested by the client application for use in
@@ -72,29 +72,29 @@ module UDAPSecurityTestKit
72
72
  )
73
73
  },
74
74
  udap_registration_certifications: {
75
- name: :udap_registration_certifications_auth_code_flow,
75
+ name: :udap_auth_code_flow_registration_certifications,
76
76
  title: 'Authorization Code UDAP Registration Certifications'
77
77
  }
78
78
  },
79
79
  outputs: {
80
80
  udap_client_cert_pem: {
81
- name: :udap_client_cert_pem_auth_code_flow
81
+ name: :udap_auth_code_flow_client_cert_pem
82
82
  },
83
83
  udap_client_private_key_pem: {
84
- name: :udap_client_private_key_auth_code_flow
84
+ name: :udap_auth_code_flow_client_private_key
85
85
  },
86
86
  udap_cert_iss: {
87
- name: :udap_cert_iss_auth_code_flow
87
+ name: :udap_auth_code_flow_cert_iss
88
88
  }
89
89
  }
90
90
  } do
91
91
  input_order :udap_registration_endpoint,
92
- :reg_grant_type_auth_code,
93
- :udap_client_cert_pem_auth_code_flow,
94
- :udap_client_private_key_auth_code_flow,
95
- :udap_cert_iss_auth_code_flow,
96
- :udap_registration_scope_auth_code_flow,
97
- :udap_jwt_signing_alg, :udap_registration_certifications_auth_code_flow
92
+ :udap_auth_code_flow_registration_grant_type,
93
+ :udap_auth_code_flow_client_cert_pem,
94
+ :udap_auth_code_flow_client_private_key,
95
+ :udap_auth_code_flow_cert_iss,
96
+ :udap_auth_code_flow_registration_scope,
97
+ :udap_jwt_signing_alg, :udap_auth_code_flow_registration_certifications
98
98
  end
99
99
 
100
100
  group from: :udap_authorization_code_authentication_group,
data/lib/udap_security_test_kit/authorization_code_redirect_test.rb CHANGED
@@ -1,3 +1,4 @@
1
+ require_relative '../udap_security_test_kit'
1
2
  module UDAPSecurityTestKit
2
3
  class AuthorizationCodeRedirectTest < Inferno::Test
3
4
  title 'Authorization server redirects client to redirect URI'
@@ -20,8 +21,6 @@ module UDAPSecurityTestKit
20
21
 
21
22
  receives_request :redirect
22
23
 
23
- config options: { redirect_uri: "#{Inferno::Application['base_url']}/custom/udap_security_test_kit/redirect" }
24
-
25
24
  def wait_message(auth_url)
26
25
  if config.options[:redirect_message_proc].present?
27
26
  return instance_exec(auth_url, &config.options[:redirect_message_proc])
@@ -49,6 +48,11 @@ module UDAPSecurityTestKit
49
48
  end
50
49
 
51
50
  run do
51
+ assert_valid_http_uri(
52
+ udap_authorization_endpoint,
53
+ "UDAP authorization endpoint '#{udap_authorization_endpoint}' is not a valid URI"
54
+ )
55
+
52
56
  output udap_authorization_code_state: SecureRandom.uuid
53
57
 
54
58
  oauth2_params = {
data/lib/udap_security_test_kit/authorization_code_token_exchange_test.rb CHANGED
@@ -23,7 +23,7 @@ module UDAPSecurityTestKit
23
23
  title: 'Token Endpoint',
24
24
  description: 'The full URL from which Inferno will request an access token'
25
25
 
26
- input :udap_client_cert_pem_auth_code_flow,
26
+ input :udap_auth_code_flow_client_cert_pem,
27
27
  title: 'X.509 Client Certificate (PEM Format)',
28
28
  type: 'textarea',
29
29
  description: %(
@@ -34,7 +34,7 @@ module UDAPSecurityTestKit
34
34
  authorization server under test.
35
35
  )
36
36
 
37
- input :udap_client_private_key_auth_code_flow,
37
+ input :udap_auth_code_flow_client_private_key,
38
38
  type: 'textarea',
39
39
  title: 'Client Private Key (PEM Format)',
40
40
  description: 'The private key corresponding to the X.509 client certificate'
@@ -57,11 +57,10 @@ module UDAPSecurityTestKit
57
57
  default: 'RS256',
58
58
  locked: true
59
59
 
60
- output :token_retrieval_time
61
- output :authorization_code_token_response_body
62
- makes_request :token_exchange
60
+ output :udap_auth_code_flow_token_retrieval_time,
61
+ :udap_auth_code_flow_token_exchange_response_body
63
62
 
64
- config options: { redirect_uri: "#{Inferno::Application['base_url']}/custom/udap_security_test_kit/redirect" }
63
+ makes_request :token_exchange
65
64
 
66
65
  run do
67
66
  client_assertion_payload = UDAPClientAssertionPayloadBuilder.build(
@@ -70,11 +69,11 @@ module UDAPSecurityTestKit
70
69
  nil
71
70
  )
72
71
 
73
- x5c_certs = UDAPJWTBuilder.split_user_input_cert_string(udap_client_cert_pem_auth_code_flow)
72
+ x5c_certs = UDAPJWTBuilder.split_user_input_cert_string(udap_auth_code_flow_client_cert_pem)
74
73
 
75
74
  client_assertion_jwt = UDAPJWTBuilder.encode_jwt_with_x5c_header(
76
75
  client_assertion_payload,
77
- udap_client_private_key_auth_code_flow,
76
+ udap_auth_code_flow_client_private_key,
78
77
  udap_jwt_signing_alg,
79
78
  x5c_certs
80
79
  )
@@ -95,9 +94,9 @@ module UDAPSecurityTestKit
95
94
  assert_response_status(200)
96
95
  assert_valid_json(request.response_body)
97
96
 
98
- output token_retrieval_time: Time.now.iso8601
97
+ output udap_auth_code_flow_token_retrieval_time: Time.now.iso8601
99
98
 
100
- output authorization_code_token_response_body: request.response_body
99
+ output udap_auth_code_flow_token_exchange_response_body: request.response_body
101
100
  end
102
101
  end
103
102
  end
data/lib/udap_security_test_kit/client_credentials_authentication_group.rb CHANGED
@@ -16,7 +16,7 @@ module UDAPSecurityTestKit
16
16
  config: {
17
17
  requests: {
18
18
  token_exchange: {
19
- name: :client_credentials_token_exchange
19
+ name: :udap_client_credentials_flow_token_exchange
20
20
  }
21
21
  }
22
22
  }
@@ -24,7 +24,21 @@ module UDAPSecurityTestKit
24
24
  config: {
25
25
  inputs: {
26
26
  token_response_body: {
27
- name: :client_credentials_token_response_body
27
+ name: :udap_client_credentials_flow_token_exchange_response_body
28
+ }
29
+ },
30
+ outputs: {
31
+ udap_access_token: {
32
+ name: :udap_client_credentials_flow_access_token
33
+ },
34
+ udap_expires_in: {
35
+ name: :udap_client_credentials_flow_expires_in
36
+ },
37
+ udap_received_scopes: {
38
+ name: :udap_client_credentials_flow_received_scopes
39
+ },
40
+ udap_refresh_token: {
41
+ name: :udap_client_credentials_flow_refresh_token
28
42
  }
29
43
  }
30
44
  }
@@ -32,7 +46,7 @@ module UDAPSecurityTestKit
32
46
  config: {
33
47
  requests: {
34
48
  token_exchange: {
35
- name: :client_credentials_token_exchange
49
+ name: :udap_client_credentials_flow_token_exchange
36
50
  }
37
51
  }
38
52
  }
data/lib/udap_security_test_kit/client_credentials_group.rb CHANGED
@@ -47,16 +47,16 @@ module UDAPSecurityTestKit
47
47
  config: {
48
48
  inputs: {
49
49
  udap_registration_grant_type: {
50
- name: :reg_grant_type_client_creds,
50
+ name: :udap_client_credentials_flow_registration_grant_type,
51
51
  default: 'client_credentials',
52
52
  locked: true
53
53
  },
54
54
  udap_client_cert_pem: {
55
- name: :udap_client_cert_pem_client_creds_flow,
55
+ name: :udap_client_credentials_flow_client_cert_pem,
56
56
  title: 'Client Credentials Client Certificate(s) (PEM Format)'
57
57
  },
58
58
  udap_client_private_key_pem: {
59
- name: :udap_client_private_key_client_creds_flow,
59
+ name: :udap_client_credentials_flow_client_private_key,
60
60
  title: 'Client Credentials Client Private Key (PEM Format)'
61
61
  },
62
62
  udap_cert_iss: {
@@ -64,7 +64,7 @@ module UDAPSecurityTestKit
64
64
  title: 'Client Credentials JWT Issuer (iss) Claim'
65
65
  },
66
66
  udap_registration_requested_scope: {
67
- name: :udap_registration_scope_client_creds_flow,
67
+ name: :udap_client_credentials_flow_registration_scope,
68
68
  title: 'Client Credentials Registration Requested Scope(s)',
69
69
  description: %(
70
70
  String containing a space delimited list of scopes requested by the client application for use in
@@ -74,16 +74,16 @@ module UDAPSecurityTestKit
74
74
  )
75
75
  },
76
76
  udap_registration_certifications: {
77
- name: :udap_registration_certifications_client_creds_flow,
77
+ name: :udap_client_creds_flow_registration_certifications,
78
78
  title: 'Client Credentials UDAP Registration Certifications'
79
79
  }
80
80
  },
81
81
  outputs: {
82
82
  udap_client_cert_pem: {
83
- name: :udap_client_cert_pem_client_creds_flow
83
+ name: :udap_client_credentials_flow_client_cert_pem
84
84
  },
85
85
  udap_client_private_key_pem: {
86
- name: :udap_client_private_key_client_creds_flow
86
+ name: :udap_client_credentials_flow_client_private_key
87
87
  },
88
88
  udap_cert_iss: {
89
89
  name: :udap_cert_iss_client_creds_flow
@@ -91,12 +91,12 @@ module UDAPSecurityTestKit
91
91
  }
92
92
  } do
93
93
  input_order :udap_registration_endpoint,
94
- :reg_grant_type_client_creds,
95
- :udap_client_cert_pem_client_creds_flow,
96
- :udap_client_private_key_client_creds_flow,
94
+ :udap_client_credentials_flow_registration_grant_type,
95
+ :udap_client_credentials_flow_client_cert_pem,
96
+ :udap_client_credentials_flow_client_private_key,
97
97
  :udap_cert_iss_client_creds_flow,
98
- :udap_registration_scope_client_creds_flow,
99
- :udap_jwt_signing_alg, :udap_registration_certifications_client_creds_flow
98
+ :udap_client_credentials_flow_registration_scope,
99
+ :udap_jwt_signing_alg, :udap_client_creds_flow_registration_certifications
100
100
  end
101
101
 
102
102
  group from: :udap_client_credentials_authentication_group,
data/lib/udap_security_test_kit/client_credentials_token_exchange_test.rb CHANGED
@@ -38,7 +38,7 @@ module UDAPSecurityTestKit
38
38
  title: 'Token Endpoint',
39
39
  description: 'The full URL from which Inferno will request an access token'
40
40
 
41
- input :udap_client_cert_pem_client_creds_flow,
41
+ input :udap_client_credentials_flow_client_cert_pem,
42
42
  title: 'X.509 Client Certificate(s) (PEM Format)',
43
43
  type: 'textarea',
44
44
  description: %(
@@ -48,7 +48,7 @@ module UDAPSecurityTestKit
48
48
  authorization server under test.
49
49
  )
50
50
 
51
- input :udap_client_private_key_client_creds_flow,
51
+ input :udap_client_credentials_flow_client_private_key,
52
52
  type: 'textarea',
53
53
  title: 'Client Private Key (PEM Format)',
54
54
  description: 'The private key corresponding to the X.509 client certificate'
@@ -71,8 +71,9 @@ module UDAPSecurityTestKit
71
71
  default: 'RS256',
72
72
  locked: true
73
73
 
74
- output :token_retrieval_time
75
- output :client_credentials_token_response_body
74
+ output :udap_client_credentials_flow_token_retrieval_time,
75
+ :udap_client_credentials_flow_token_exchange_response_body
76
+
76
77
  makes_request :token_exchange
77
78
 
78
79
  run do
@@ -97,12 +98,12 @@ module UDAPSecurityTestKit
97
98
  )
98
99
 
99
100
  x5c_certs = UDAPJWTBuilder.split_user_input_cert_string(
100
- udap_client_cert_pem_client_creds_flow
101
+ udap_client_credentials_flow_client_cert_pem
101
102
  )
102
103
 
103
104
  client_assertion_jwt = UDAPJWTBuilder.encode_jwt_with_x5c_header(
104
105
  client_assertion_payload,
105
- udap_client_private_key_client_creds_flow,
106
+ udap_client_credentials_flow_client_private_key,
106
107
  udap_jwt_signing_alg,
107
108
  x5c_certs
108
109
  )
@@ -122,9 +123,9 @@ module UDAPSecurityTestKit
122
123
  assert_response_status(200)
123
124
  assert_valid_json(request.response_body)
124
125
 
125
- output token_retrieval_time: Time.now.iso8601
126
+ output udap_client_credentials_flow_token_retrieval_time: Time.now.iso8601
126
127
 
127
- output client_credentials_token_response_body: request.response_body
128
+ output udap_client_credentials_flow_token_exchange_response_body: request.response_body
128
129
  end
129
130
  end
130
131
  end
data/lib/udap_security_test_kit/redirect_uri.rb ADDED
@@ -0,0 +1,3 @@
1
+ module UDAPSecurityTestKit
2
+ UDAP_REDIRECT_URI = "#{Inferno::Application['base_url']}/custom/udap_security/redirect".freeze
3
+ end
data/lib/udap_security_test_kit/registration_success_contents_test.rb CHANGED
@@ -15,14 +15,25 @@ module UDAPSecurityTestKit
15
15
  > use by the Client App, the software statement as submitted by the Client App, and all of the registration
16
16
  > related parameters that were included in the software statement.
17
17
 
18
+ [UDAP STU 1.1](https://hl7.org/fhir/us/udap-security/STU1.1/registration.html#request-body) clarifies that,
19
+ in accordance with [Section 3.2.1 of RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1):
20
+ > The authorization server MAY reject or replace any of the client's requested metadata values submitted during
21
+ > the registration and substitute them with suitable values.
22
+
18
23
  This test verifies:
19
- - `client_id` claim is included in the registration response and its value is not blank
20
- - `software_statement` claim in the registration response matches the software statement JWT provided in the
21
- original registration request
22
- - The registration response includes claims for `client_name`, `grant_types`, `token_endpoint_auth_method`, and
23
- `scope`, whose values match those in the originally submitted software statement
24
- - If the registered grant type is `authorization_code`, then the response includes claims for `redirect_uris` and
25
- `response_type` whose values match those in the originally submitted software statement
24
+ - `client_id` claim is present in the registration response and its value is not blank.
25
+ - `scope` and `client_name` claims are present in the registration response and their values are not blank.
26
+ - `software_statement`, `grant_types`, and `token_endpoint_auth_method` claims are present in the registration
27
+ response and their values match those in the originally submitted software statement.
28
+ - If the registered grant type is `authorization_code`, then the `redirect_uris` and `response_type` claims are
29
+ present in the registration response and their values match in the originally submitted software statement.
30
+
31
+ In order for downstream tests to succeed, it is
32
+ essential that the client and server are in agreement on the values of most of the software statement
33
+ parameters. The exception is `client_name`, which does not impact behavior. For this reason, an exact match
34
+ between the request and response values for `client_name` is not required.
35
+ Additionally, an exact match between `scope` request and response value is also not required because the
36
+ authorization server may grant different scopes than those orignally requested by the client.
26
37
  )
27
38
 
28
39
  input :udap_software_statement_json
@@ -48,16 +59,23 @@ module UDAPSecurityTestKit
48
59
 
49
60
  original_software_statement = JSON.parse(udap_software_statement_json)
50
61
 
51
- expected_claims = ['client_name', 'grant_types', 'token_endpoint_auth_method', 'scope']
62
+ expected_claims = ['scope', 'client_name', 'grant_types', 'token_endpoint_auth_method']
52
63
  auth_code_claims = ['redirect_uris', 'response_types']
53
64
 
65
+ # For this subset, authorization server may return a different value than
66
+ # the one originally provided in client software statement
67
+ mutable_claims = ['scope', 'client_name']
68
+
54
69
  expected_claims.concat auth_code_claims if udap_registration_grant_type == 'authorization_code'
55
70
 
56
71
  expected_claims.each do |claim|
57
72
  assert registration_response.key?(claim), "Successful registration response must include #{claim} claim"
73
+ assert registration_response[claim].present?, "`#{claim}` value cannot be blank"
74
+ next if mutable_claims.include?(claim)
75
+
58
76
  assert registration_response[claim] == original_software_statement[claim],
59
77
  "Registration response value for #{claim} does not match " \
60
- 'in client-submitted software statement'
78
+ 'value in client-submitted software statement'
61
79
  end
62
80
  end
63
81
  end
data/lib/udap_security_test_kit/software_statement_builder.rb CHANGED
@@ -1,10 +1,11 @@
1
1
  require 'jwt'
2
+ require_relative 'redirect_uri'
2
3
 
3
4
  module UDAPSecurityTestKit
4
5
  class SoftwareStatementBuilder
5
6
  def self.build_payload(iss, aud, grant_type, scope)
6
7
  if grant_type == 'authorization_code'
7
- redirect_uris = ["#{Inferno::Application['base_url']}/custom/udap_security_test_kit/redirect"]
8
+ redirect_uris = [UDAPSecurityTestKit::UDAP_REDIRECT_URI]
8
9
  response_types = ['code']
9
10
  client_name = 'Inferno UDAP Authorization Code Test Client'
10
11
  elsif grant_type == 'client_credentials'
data/lib/udap_security_test_kit/token_exchange_response_body_test.rb CHANGED
@@ -15,10 +15,20 @@ module UDAPSecurityTestKit
15
15
 
16
16
  input :token_response_body
17
17
 
18
+ output :udap_access_token,
19
+ :udap_expires_in,
20
+ :udap_received_scopes,
21
+ :udap_refresh_token
22
+
18
23
  run do
19
24
  assert_valid_json(token_response_body)
20
25
  token_response_body_parsed = JSON.parse(token_response_body)
21
26
 
27
+ output udap_access_token: token_response_body_parsed['access_token'],
28
+ udap_expires_in: token_response_body_parsed['expires_in'],
29
+ udap_received_scopes: token_response_body_parsed['scope'],
30
+ udap_refresh_token: token_response_body_parsed['refresh_token']
31
+
22
32
  required_keys = ['access_token', 'token_type']
23
33
 
24
34
  required_keys.each do |key|
data/lib/udap_security_test_kit/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module UDAPSecurityTestKit
2
- VERSION = '0.9.2'.freeze
2
+ VERSION = '0.10.1'.freeze
3
3
  end
data/lib/udap_security_test_kit.rb CHANGED
@@ -1,6 +1,7 @@
1
1
  require_relative 'udap_security_test_kit/authorization_code_group'
2
2
  require_relative 'udap_security_test_kit/client_credentials_group'
3
3
  require_relative 'udap_security_test_kit/version'
4
+ require_relative 'udap_security_test_kit/redirect_uri'
4
5
 
5
6
  module UDAPSecurityTestKit
6
7
  class Suite < Inferno::TestSuite
@@ -17,7 +18,8 @@ module UDAPSecurityTestKit
17
18
  2. Dynamic Client Registration
18
19
  3. Authorization & Authentication
19
20
 
20
- These steps are grouped by the OAuth2.0 flow being tested:
21
+ In this test suite, Inferno acts as a mock UDAP client to test *server conformance* to the HL7 UDAP IG. Tests are
22
+ grouped according to the OAuth2.0 flow used in the authorization and authentication step:
21
23
  1. Authorization Code flow, which supports
22
24
  [Consumer-Facing](https://hl7.org/fhir/us/udap-security/STU1/consumer.html) or [Business-to-Business (B2B)](https://hl7.org/fhir/us/udap-security/STU1/b2b.html)
23
25
  use cases
@@ -25,6 +27,9 @@ module UDAPSecurityTestKit
25
27
  [B2B](https://hl7.org/fhir/us/udap-security/STU1/b2b.html) use case
26
28
 
27
29
  Testers may test one or both flows based on their system under test.
30
+
31
+ This test suite does NOT assess [Tiered OAuth for User Authentication](https://hl7.org/fhir/us/udap-security/STU1/user.html)
32
+ (which is not a required capability) or client conformance to the HL7 UDAP IG.
28
33
  )
29
34
 
30
35
  input_instructions %(
@@ -57,6 +62,10 @@ module UDAPSecurityTestKit
57
62
  request.query_parameters['state']
58
63
  end
59
64
 
65
+ config options: {
66
+ redirect_uri: UDAPSecurityTestKit::UDAP_REDIRECT_URI
67
+ }
68
+
60
69
  links [
61
70
  {
62
71
  label: 'Report Issue',
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: udap_security_test_kit
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.9.2
4
+ version: 0.10.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Stephen MacVicar
@@ -9,7 +9,7 @@ authors:
9
9
  autorequire:
10
10
  bindir: bin
11
11
  cert_chain: []
12
- date: 2024-10-07 00:00:00.000000000 Z
12
+ date: 2024-12-06 00:00:00.000000000 Z
13
13
  dependencies:
14
14
  - !ruby/object:Gem::Dependency
15
15
  name: inferno_core
@@ -17,14 +17,14 @@ dependencies:
17
17
  requirements:
18
18
  - - ">="
19
19
  - !ruby/object:Gem::Version
20
- version: 0.4.2
20
+ version: 0.5.1
21
21
  type: :runtime
22
22
  prerelease: false
23
23
  version_requirements: !ruby/object:Gem::Requirement
24
24
  requirements:
25
25
  - - ">="
26
26
  - !ruby/object:Gem::Version
27
- version: 0.4.2
27
+ version: 0.5.1
28
28
  - !ruby/object:Gem::Dependency
29
29
  name: jwt
30
30
  requirement: !ruby/object:Gem::Requirement
@@ -67,6 +67,7 @@ files:
67
67
  - lib/udap_security_test_kit/dynamic_client_registration_group.rb
68
68
  - lib/udap_security_test_kit/generate_client_certs_test.rb
69
69
  - lib/udap_security_test_kit/grant_types_supported_field_test.rb
70
+ - lib/udap_security_test_kit/redirect_uri.rb
70
71
  - lib/udap_security_test_kit/reg_endpoint_jwt_signing_alg_values_supported_field_test.rb
71
72
  - lib/udap_security_test_kit/registration_endpoint_field_test.rb
72
73
  - lib/udap_security_test_kit/registration_failure_invalid_contents_test.rb
@@ -117,7 +118,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
117
118
  - !ruby/object:Gem::Version
118
119
  version: '0'
119
120
  requirements: []
120
- rubygems_version: 3.5.9
121
+ rubygems_version: 3.3.7
121
122
  signing_key:
122
123
  specification_version: 4
123
124
  summary: UDAP Security IG Test Kit