search

openid-certification / oidctest

THE CERTIFICATION TEST SUITE HAS BEEN MIGRATED TO A NEW SERVICE https://www.certificatinon.openid.net
Other
49 stars 15 forks source link

OP-IDToken-C-Signature should not run for 'none' #212

Open jogu opened 4 years ago

jogu commented 4 years ago

As per email from myself and Roland's reply on certification list:

My understanding is that a OP that doesn't support any signing can certify if it only issues id_tokens in the back channel.

Basically, if the test description does not specify any special algorithm in the registration phase or as part of the assertions then any algorithm the RP supports can be used.

Looking at https://github.com/rohe/oidctest/blob/master/test_tool/cp/test_op/flows/OP-IDToken-C-Signature.json I believe that test will be included for 'none' and will fail (as it seems to insist that the id_token is signed using RS256). Have I missed something?

No, you’re right! The test is there because RS256 is the default.

There is the OP-IDToken-anyalg test which is there to cover the ‘none’ case.

(The test does appear on the list if I configure with none & response_type=code: https://op.certification.openid.net:62070 )

I think we should remove it from that list.