tomevault-io Scope and Claims Test Case Reviewer
Review test cases for Scope and Claims handling in OpenID Connect Basic OP.
Scope
- Feature: Scope and Claims
- Specifications: OIDC Core 1.0 Section 5.4, 5.5
- Profile: Basic OP
Review Process
- Identify which scope/claims requirement the test targets
- Check against the checklist below
- Verify both success and error scenarios
- Ensure claim filtering based on scope works correctly
- Report gaps with specific spec section references
OpenID Scope (Mandatory)
OP-scope-openid
| Check | Requirement | Spec Reference |
|---|---|---|
| [ ] | MUST support openid scope |
OIDC Core 3.1.2.1 |
| [ ] | openid scope REQUIRED in auth request |
OIDC Core 3.1.2.1 |
| [ ] | Return invalid_scope if openid missing |
OIDC Core 3.1.2.1 |
Standard Scopes
Scope Definitions
| Scope | Description | Spec Reference |
|---|---|---|
openid |
Required for OIDC requests | OIDC Core 3.1.2.1 |
profile |
Basic profile information | OIDC Core 5.4 |
email |
Email address and verification | OIDC Core 5.4 |
address |
Postal address | OIDC Core 5.4 |
phone |
Phone number and verification | OIDC Core 5.4 |
offline_access |
Refresh token (if supported) | OIDC Core 11 |
Scope to Claims Mapping
profile Scope
| Check | Claim | Type | Spec Reference |
|---|---|---|---|
| [ ] | name |
string | OIDC Core 5.1 |
| [ ] | family_name |
string | OIDC Core 5.1 |
| [ ] | given_name |
string | OIDC Core 5.1 |
| [ ] | middle_name |
string | OIDC Core 5.1 |
| [ ] | nickname |
string | OIDC Core 5.1 |
| [ ] | preferred_username |
string | OIDC Core 5.1 |
| [ ] | profile |
string (URL) | OIDC Core 5.1 |
| [ ] | picture |
string (URL) | OIDC Core 5.1 |
| [ ] | website |
string (URL) | OIDC Core 5.1 |
| [ ] | gender |
string | OIDC Core 5.1 |
| [ ] | birthdate |
string (YYYY-MM-DD) | OIDC Core 5.1 |
| [ ] | zoneinfo |
string (timezone) | OIDC Core 5.1 |
| [ ] | locale |
string (BCP47) | OIDC Core 5.1 |
| [ ] | updated_at |
number (Unix time) | OIDC Core 5.1 |
email Scope
| Check | Claim | Type | Spec Reference |
|---|---|---|---|
| [ ] | email |
string | OIDC Core 5.1 |
| [ ] | email_verified |
boolean | OIDC Core 5.1 |
address Scope
| Check | Claim | Type | Spec Reference |
|---|---|---|---|
| [ ] | address |
JSON object | OIDC Core 5.1.1 |
Address object fields:
formatted- Full mailing addressstreet_address- Street address (may include newlines)locality- City or localityregion- State, province, prefecturepostal_code- Zip or postal codecountry- Country name
phone Scope
| Check | Claim | Type | Spec Reference |
|---|---|---|---|
| [ ] | phone_number |
string (E.164) | OIDC Core 5.1 |
| [ ] | phone_number_verified |
boolean | OIDC Core 5.1 |
Claims in ID Token vs UserInfo
| Check | Requirement | Spec Reference |
|---|---|---|
| [ ] | sub always in ID Token |
OIDC Core 2 |
| [ ] | Other claims MAY be in ID Token or UserInfo | OIDC Core 5.3 |
| [ ] | Claims based on requested scopes | OIDC Core 5.4 |
Test Case Categories
OpenID Scope Tests
- Valid: Request with
scope=openid - Valid: Request with
scope=openid profile - Invalid: Request without openid scope
- Error: Returns
invalid_scope
Profile Scope Tests
- Valid: Profile claims returned when scope=profile
- Valid: Only available claims returned (not all required)
- Valid: No error if some claims unavailable
Email Scope Tests
- Valid: email and email_verified returned
- Valid: email_verified is boolean
Address Scope Tests
- Valid: address object returned
- Valid: address contains expected fields
- Valid: formatted field contains full address
Phone Scope Tests
- Valid: phone_number returned (E.164 format)
- Valid: phone_number_verified is boolean
Multiple Scopes Tests
- Valid:
scope=openid profile email - Valid: Combined claims from all scopes
- Valid: Unknown scopes ignored (no error)
Claim Location Tests
- Valid: Claims in UserInfo endpoint
- Valid: Claims in ID Token (if configured)
- Valid:
subconsistent across both
Handling Unknown/Unsupported Scopes
| Check | Requirement | Spec Reference |
|---|---|---|
| [ ] | MAY ignore unknown scopes | OIDC Core 3.1.2.1 |
| [ ] | Return granted scopes if different | OAuth 2.1 4.1.4 |
| [ ] | No error for unsupported optional scopes | OIDC Core 5.4 |
Error Cases
| Scenario | Error Code | Spec Reference |
|---|---|---|
| Missing openid scope | invalid_scope |
OIDC Core 3.1.2.1 |
| Invalid scope format | invalid_scope |
OAuth 2.1 4.1.2.1 |
Conformance Test IDs
| Test ID | Feature |
|---|---|
| OP-scope-openid | openid scope required |
| OP-scope-profile | profile scope handling |
| OP-scope-email | email scope handling |
| OP-scope-address | address scope handling |
| OP-scope-phone | phone scope handling |
| OP-scope-All | Multiple scopes combined |
Review Output Format
## Test Case: [Name]
### Target Feature: Scope/Claims - [specific scope or claim]
### Test ID: OP-scope-[xxx] or OP-claims-[xxx]
### Spec Compliance:
- [x] Covers required behavior per [spec section]
- [ ] Missing: [specific requirement]
### Scope Handling:
- [x/blank] openid scope enforced
- [x/blank] Correct claims for scope
### Verdict: PASS / FAIL / PARTIAL
### Recommendations: [if any]
Source: maronnjapan/maronn-openid-provider — distributed by TomeVault.