UMA1 Interop Features and Feature Tests

Main UMA1 Interop Testing page | Participants and Solutions | Results

The feature tests provided below are historical. We are redesigning them in light of feedback from the OpenID Connect interop and conformance testing process and Roland Hedberg's UMA test suite implementation process. The tests below may be inaccurate with respect to UMA V1.0 Candidate specs, as they date from the pre-V0.9 era.

These feature tests relate exclusively to the core protocol specification, any other normatively referenced technical specifications, and the software entities that serve as protocol endpoints implementing these specifications. None relate to the Binding Obligations specification because that spec describes expected behaviors of operators and users of these endpoints, which makes them untestable for the purposes of an interop. Feature tests are marked as either required (req) or optional (opt) based on the optionality of the underlying spec clauses they're derived from, where req is for all testable MUST/REQUIRED clauses and opt is for all other testable clauses. We have not yet defined what "full conformance" means in any formal sense. (A few untestable clauses do appear in the technical specifications.)

A feature test identifier has three parts, separated by hyphens. Every identifier starts with FT. The second part indicates the software entity being tested: AS, RS, or C. The third part, which may have embedded hyphens, describes the nature of the test. The supporting clauses in the technical specifications have been classified using feature "tags". The tests are grouped under primary feature tags for ease of test result reporting.

Feature tests for "config"

Machine-readability of entity capabilities and constraints.

ID	req/opt	Description	Success
FT-as-config-data	req	AS provides configuration data that conforms to specified formats and provides all required properties and values.	Data conforms and is complete
FT-as-config-endpt	req	AS makes config data available through https://*as_uri*/.well-known/uma-configuration.	AS config data endpoint uses https: scheme with specific URL form, with a valid certificate
FT-rs-get-config-data	opt	RS successfully accesses and parses AS config data properties it needs at https://*as_uri*/.well-known/uma-configuration, including all endpoint-related properties not specific to the RS and including handling of non-understood extension properties.	RS successfully accesses and parses AS config data
FT-c-get-config-data	opt	Client successfully accesses and parses AS config data properties it needs at https://*as_uri*/.well-known/uma-configuration, including all endpoint-related properties not specific to the client and including handling of non-understood extension properties.	Client successfully accesses and parses AS config data

Feature tests for "dynreg"

Client registration of resource servers (which are clients of the AS's protection API) and clients of resource servers (which are also clients of the AS's authorization API) at run time when services have not "met" before a resource owner or requesting party forces the issue.

ID	req/opt	Description	Success
FT-as-dyn-client-reg	opt	AS config data "dynamic_client_endpoint" property provides a URI value	Property has a URI provided
FT-rs-get-dyn-client-creds	opt	RS interacts with AS to request and receive client credentials dynamically	RS gets client credentials dynamically
FT-c-get-dyn-client-creds	opt	C interacts with AS to request and receive client credentials dynamically	C gets client credentials dynamically

Feature tests for "pat"

"Protection of the protection API" at the authorization server, and the association made between the authorization server, resource server, and resource owner as a result of protection API token (PAT) issuance.

ID	req/opt	Description	Success
FT-rs-get-pat	req	AS issues PAT to RS using OAuth authorization_code grant flow and request for protection API scope	AS issues PAT to RS IFF RS engages correctly
FT-as-require-pat	req	AS requires OAuth clients of protection API (definitionally, RSs) to present valid OAuth access tokens with protection API scope in order to use endpoints	AS allows RSs to make protection API calls IFF they present protection API scope
FT-rs-use-pat	req	RS presents valid OAuth access token with protection API scope when making calls to all protection API endpoints	RS presents PAT to all protection API endpoints

Feature tests for "aat"

"Protection of the authorization API" at the authorization server, and the association made between the authorization server, client, and requesting party as a result of authorization API token (AAT) issuance.

ID	req/opt	Description	Success
FT-c-get-aat	req	AS issues AAT to Client given OAuth authorization_code grant flow and request for authorization API scope	AS issues AAT to client IFF client engages correctly
FT-as-require-aat	req	AS requires OAuth clients of authorization API (definitionally, Clients) to present valid OAuth access tokens with authorization API scope in order to use endpoints	AS allows Client to make authorization API calls IFF they present authorization API scope
FT-c-use-aat	req	Client presents valid OAuth access token with authorization API scope when making calls to all authorization API endpoints	Client presents AAT to all authorization API endpoints

Feature tests for "protapi"

RS-AS communication through the protection API and its various endpoints.

ID	req/opt	Description	Success
FT-as-rsr	req	AS presents all of the following methods at a resource set registration endpoint of form *rsreguri/resource_set/rsid*, and treats others as unsupported: PUT with unique ID to register new resource set description; GET with unique ID to read already-registered resource set description, handling the presence of any policy_uri property in AS's response; PUT with If-Match and unique ID to update already-registered resource set description, handling the presence of any policy_uri property in AS's response; DELETE with a unique ID to delete an already-registered resource set description; and GET on resource_set path to read list of already-registered resource set descriptions.	RS able to use all elements of resource set registration API
FT-rs-rsr	req	RS uses: PUT with unique ID to register new resource set description; GET with unique ID to read already-registered resource set description, handling the presence of any policy_uri property in AS's response; PUT with If-Match and unique ID to update already-registered resource set description, handling the presence of any policy_uri property in AS's response; DELETE with a unique ID to delete an already-registered resource set description; and GET on resource_set path to read list of already-registered resource set descriptions. RS links to well-formed scope descriptions and provides well-formed resource set descriptions.	RS uses all elements of resource set registration API and scope and resource set description formats correctly
FT-as-rsr-error	req	AS issues errors for resource set registration error conditions, including unsupported_method_type, not_found, and precondition_failed.	AS issues resource set registration API errors for error conditions
FT-as-rsr-scope-ext	req	If a scope description contains extension properties, the AS proceeds normally in handling the scope description.	AS does not produce an error on encountering extension properties in scope description
FT-as-introspect	req	AS presents the token introspection endpoint, supporting only the POST method.	RS able to use token introspection endpoint
FT-rs-introspect	req	RS presents a valid RPT at AS's token introspection endpoint to get token's status.	RS gets well-formed RPT status
FT-as-reg-perm	req	AS presents a permission registration endpoint that enables RS to register permission associated with correct resource owner, resource set, and scopes, and returns securely random permission ticket in response to RS registration of requested permission.	AS returns permission ticket that is securely random
FT-rs-reg-perm	req	RS presents a valid PAT, and valid previously registered resource set and scope information, at AS's permission registration endpoint to register a requested permission that is relevant for the type of access attempted by client.	RS registers requested permission

Feature tests for "authzapi"

C-AS communication through the authorization API and its various endpoints.

ID	req/opt	Role	Description	Success
FT-as-rpt	req	AS	AS presents the RPT endpoint and AS issues RPT in response to client's request for an RPT at the correct endpoint with a valid AAT.	Client able to get RPT using endpoint
FT-c-rpt	req	C	Client presents valid AAT at AS's RPT endpoint to get RPT.	Client gets new or refreshed RPT
FT-c-authz-data	req	C	Client presents valid AAT, valid RPT, and permission ticket at AS's authorization endpoint to POST request that authorization data be associated with RPT.	Client receives back normal success or error message
FT-as-authz-data-deny	req	AS	AS determines that the client should not get authorization data, and returns either an invalid_ticket error, an expired_ticket error, or a not_authorized_permission error.	AS returns one of the errors
FT-as-authz-data-give	req	AS	AS associates new authorization data with the RPT that the client presented and responds with success.	AS adds authorization data and responds with success
FT-as-need-claims	req	AS	AS indicates it needs requesting party claims to considering adding permission to "bearer" profile RPT.	AS responds to the client with a need_claims error

Feature tests for "access"

C-RS communication through the UMA-protected resource interface for the purpose of attempting and granting or denying access.

ID	req/opt	Role	Description	Success
FT-rs-no-rpt	req	RS	RS responds to client not bearing an RPT with HTTP 401 and correct as_uri corresponding to AS protecting the resource to which access was attempted.	RS responds with HTTP 401 and as_uri
FT-rs-invalid-rpt	req	RS	RS responds to client bearing an invalid RPT with HTTP 401 and correct as_uri corresponding to AS protecting the resource to which access was attempted.	RS responds with HTTP 401 and as_uri
FT-c-rpt	req	C	C requests access to a resource by providing a correctly formed and located RPT.
FT-rs-insufficient-perm	req	RS	RS responds to client bearing a valid "bearer" profile RPT that has insufficient permissions with HTTP 403, as_uri, and permission ticket corresponding to resource for which access was attempted. NOTE: Conducting this test depends on RS-specific API and scope details.	RS responds with HTTP 403, as_uri, and permission ticket
FT-rs-respect-authz	req	RS	RS limits access to resource that is currently under protection at an AS for which a valid RPT with valid authorization data has not been presented by a client. NOTE: Conducting this test depends on RS-specific API and scope details.	RS blocks and grants client's access according to RPT's current status

Feature tests for "claims"

TBS.