majiayu000 ID Token Test Case Reviewer
Review test cases for ID Token generation and validation in OpenID Connect Basic OP.
Scope
- Feature: ID Token Claims and Signature
- Specifications: OIDC Core 1.0 Section 2, 3.1.3.6, 3.1.3.7
- Profile: Basic OP (Authorization Code Flow)
Review Process
- Identify which ID Token requirement the test targets
- Check against the checklist below
- Verify both valid and invalid token scenarios
- Ensure signature algorithm (RS256) is tested
- Report gaps with specific spec section references
ID Token Structure
Header.Payload.Signature
JOSE Header Requirements
| Field | Requirement | Example |
|---|---|---|
alg |
REQUIRED. Signing algorithm | RS256 |
kid |
RECOMMENDED. Key ID | 1e9gdk7 |
typ |
OPTIONAL. Type | JWT |
Required Claims Checklist
| Check | Claim | Requirement | Spec Reference |
|---|---|---|---|
| [ ] | iss |
REQUIRED. Issuer Identifier (HTTPS URL, no query/fragment) | OIDC Core 2 |
| [ ] | sub |
REQUIRED. Subject Identifier (max 255 ASCII chars) | OIDC Core 2 |
| [ ] | aud |
REQUIRED. Audience (contains client_id) | OIDC Core 2 |
| [ ] | exp |
REQUIRED. Expiration time | OIDC Core 2 |
| [ ] | iat |
REQUIRED. Issued at time | OIDC Core 2 |
Conditional Claims Checklist
| Check | Claim | Condition | Spec Reference |
|---|---|---|---|
| [ ] | nonce |
REQUIRED if nonce in auth request | OIDC Core 3.1.3.6 |
| [ ] | auth_time |
REQUIRED if max_age requested or auth_time essential | OIDC Core 2 |
| [ ] | azp |
REQUIRED if aud contains multiple values | OIDC Core 2 |
| [ ] | at_hash |
OPTIONAL for code flow | OIDC Core 3.1.3.6 |
Signature Requirements
| Check | Requirement | Spec Reference |
|---|---|---|
| [ ] | ID Token MUST be signed JWT | OIDC Core 2 |
| [ ] | Support RS256 algorithm (MANDATORY) | OIDC Core 15.1 |
| [ ] | alg header parameter present |
OIDC Core 2 |
| [ ] | kid header parameter present if multiple keys |
OIDC Core 10.1 |
Validation Rules (OP produces valid tokens)
| Check | Validation Rule | Spec Reference |
|---|---|---|
| [ ] | iss exactly matches OP's Issuer Identifier |
OIDC Core 3.1.3.7 |
| [ ] | aud contains requesting client's client_id |
OIDC Core 3.1.3.7 |
| [ ] | exp is in the future |
OIDC Core 3.1.3.7 |
| [ ] | Signature verifiable with OP's public key | OIDC Core 3.1.3.7 |
Test Case Categories
Issuer (iss) Tests
- Valid:
issmatches configured OP issuer exactly - Invalid:
issadds query parameters - Invalid:
issadds fragment - Invalid:
issdiffers by trailing slash - Invalid:
issdiffers by scheme (http vs https) - Invalid:
issis missing
Audience (aud) Tests
- Valid:
audequals client_id (string) - Valid:
audis array containing client_id - Invalid:
auddoesn't contain client_id - Invalid:
audis missing
Authorized Party (azp) Tests
- Valid: Single aud, no azp required
- Valid: Multiple aud, azp equals client_id
- Warning: Multiple aud, azp missing
- Invalid: azp present but doesn't match client_id
Expiration (exp) Tests
- Valid: exp is in future
- Valid: Small clock skew tolerance (typically 5 minutes)
- Invalid: exp is in past
- Invalid: exp is missing
Nonce Tests
- Valid: nonce matches request nonce
- Valid: No nonce in request, no nonce in token (code flow)
- Invalid: nonce requested but missing in token
- Invalid: nonce doesn't match request
Signature Tests
- Valid: RS256 signature verifies with OP's public key
- Valid: Retrieve key via kid from JWKS
- Invalid: Signature doesn't verify
- Invalid: Unknown kid
- Invalid: Algorithm mismatch
- Invalid: alg is none when signature required
Review Output Format
## Test Case: [Name]
### Target Feature: ID Token - [specific aspect]
### Test ID: OP-IDToken-[xxx]
### Spec Compliance:
- [x] Covers required behavior per [spec section]
- [ ] Missing: [specific requirement]
### Verdict: PASS / FAIL / PARTIAL
### Recommendations: [if any]
Example Valid ID Token
{
"iss": "https://server.example.com",
"sub": "248289761001",
"aud": "s6BhdRkqt3",
"nonce": "n-0S6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}