UMA1 Interop Features and Feature Tests

FT-as-config-data

req

AS provides configuration data that conforms to specified formats and provides all required properties and values.

Data conforms and is complete

FT-as-config-endpt

req

AS makes config data available through https://as_uri/.well-known/uma-configuration.

AS config data endpoint uses https: scheme with specific URL form, with a valid certificate

FT-rs-get-config-data

opt

RS successfully accesses and parses AS config data properties it needs at https://as_uri/.well-known/uma-configuration, including all endpoint-related properties not specific to the RS and including handling of non-understood extension properties.

RS successfully accesses and parses AS config data

FT-c-get-config-data

opt

Client successfully accesses and parses AS config data properties it needs at https://as_uri/.well-known/uma-configuration, including all endpoint-related properties not specific to the client and including handling of non-understood extension properties.

Client successfully accesses and parses AS config data

FT-as-dyn-client-reg

opt

AS config data "dynamic_client_endpoint" property provides a URI value

Property has a URI provided

FT-rs-get-dyn-client-creds

opt

RS interacts with AS to request and receive client credentials dynamically

RS gets client credentials dynamically

FT-c-get-dyn-client-creds

opt

C interacts with AS to request and receive client credentials dynamically

C gets client credentials dynamically

FT-rs-get-pat

req

AS issues PAT to RS using OAuth authorization_code grant flow and request for protection API scope

AS issues PAT to RS IFF RS engages correctly

FT-as-require-pat

req

AS requires OAuth clients of protection API (definitionally, RSs) to present valid OAuth access tokens with protection API scope in order to use endpoints

AS allows RSs to make protection API calls IFF they present protection API scope

FT-rs-use-pat

req

RS presents valid OAuth access token with protection API scope when making calls to all protection API endpoints

RS presents PAT to all protection API endpoints

FT-c-get-aat

req

AS issues AAT to Client given OAuth authorization_code grant flow and request for authorization API scope

AS issues AAT to client IFF client engages correctly

FT-as-require-aat

req

AS requires OAuth clients of authorization API (definitionally, Clients) to present valid OAuth access tokens with authorization API scope in order to use endpoints

AS allows Client to make authorization API calls IFF they present authorization API scope

FT-c-use-aat

req

Client presents valid OAuth access token with authorization API scope when making calls to all authorization API endpoints

Client presents AAT to all authorization API endpoints

FT-as-rsr

req

AS presents all of the following methods at a resource set registration endpoint of form rsreguri/resource_set/rsid, and treats others as unsupported: PUT with unique ID to register new resource set description; GET with unique ID to read already-registered resource set description, handling the presence of any policy_uri property in AS's response; PUT with If-Match and unique ID to update already-registered resource set description, handling the presence of any policy_uri property in AS's response; DELETE with a unique ID to delete an already-registered resource set description; and GET on resource_set path to read list of already-registered resource set descriptions.

RS able to use all elements of resource set registration API

FT-rs-rsr

req

RS uses: PUT with unique ID to register new resource set description; GET with unique ID to read already-registered resource set description, handling the presence of any policy_uri property in AS's response; PUT with If-Match and unique ID to update already-registered resource set description, handling the presence of any policy_uri property in AS's response; DELETE with a unique ID to delete an already-registered resource set description; and GET on resource_set path to read list of already-registered resource set descriptions. RS links to well-formed scope descriptions and provides well-formed resource set descriptions.

RS uses all elements of resource set registration API and scope and resource set description formats correctly

FT-as-rsr-error

req

AS issues errors for resource set registration error conditions, including unsupported_method_type, not_found, and precondition_failed.

AS issues resource set registration API errors for error conditions

FT-as-rsr-scope-ext

req

If a scope description contains extension properties, the AS proceeds normally in handling the scope description.

AS does not produce an error on encountering extension properties in scope description

FT-as-introspect

req

AS presents the token introspection endpoint, supporting only the POST method.

RS able to use token introspection endpoint

FT-rs-introspect

req

RS presents a valid RPT at AS's token introspection endpoint to get token's status.

RS gets well-formed RPT status

FT-as-reg-perm

req

AS presents a permission registration endpoint that enables RS to register permission associated with correct resource owner, resource set, and scopes, and returns securely random permission ticket in response to RS registration of requested permission.

AS returns permission ticket that is securely random

FT-rs-reg-perm

req

RS presents a valid PAT, and valid previously registered resource set and scope information, at AS's permission registration endpoint to register a requested permission that is relevant for the type of access attempted by client.

RS registers requested permission

FT-as-rpt

req

AS

AS presents the RPT endpoint and AS issues RPT in response to client's request for an RPT at the correct endpoint with a valid AAT.

Client able to get RPT using endpoint

FT-c-rpt

req

C

Client presents valid AAT at AS's RPT endpoint to get RPT.

Client gets new or refreshed RPT

FT-c-authz-data

req

C

Client presents valid AAT, valid RPT, and permission ticket at AS's authorization endpoint to POST request that authorization data be associated with RPT.

Client receives back normal success or error message

FT-as-authz-data-deny

req

AS

AS determines that the client should not get authorization data, and returns either an invalid_ticket error, an expired_ticket error, or a not_authorized_permission error.

AS returns one of the errors

FT-as-authz-data-give

req

AS

AS associates new authorization data with the RPT that the client presented and responds with success.

AS adds authorization data and responds with success

FT-as-need-claims

req

AS

AS indicates it needs requesting party claims to considering adding permission to "bearer" profile RPT.

AS responds to the client with a need_claims error

FT-rs-no-rpt

req

RS

RS responds to client not bearing an RPT with HTTP 401 and correct as_uri corresponding to AS protecting the resource to which access was attempted.

RS responds with HTTP 401 and as_uri

FT-rs-invalid-rpt

req

RS

RS responds to client bearing an invalid RPT with HTTP 401 and correct as_uri corresponding to AS protecting the resource to which access was attempted.

RS responds with HTTP 401 and as_uri

FT-c-rpt

req

C

C requests access to a resource by providing a correctly formed and located RPT.

FT-rs-insufficient-perm

req

RS

RS responds to client bearing a valid "bearer" profile RPT that has insufficient permissions with HTTP 403, as_uri, and permission ticket corresponding to resource for which access was attempted. NOTE: Conducting this test depends on RS-specific API and scope details.

RS responds with HTTP 403, as_uri, and permission ticket

FT-rs-respect-authz

req

RS

RS limits access to resource that is currently under protection at an AS for which a valid RPT with valid authorization data has not been presented by a client. NOTE: Conducting this test depends on RS-specific API and scope details.

RS blocks and grants client's access according to RPT's current status