UserInfo Endpoint Test Case Reviewer
Review test cases for UserInfo Endpoint in OpenID Connect Basic OP.
Scope
- Feature: UserInfo Endpoint
- Specifications: OIDC Core 1.0 Section 5.3, 5.4
- Profile: Basic OP
Review Process
- Identify which UserInfo requirement the test targets
- Check against the checklist below
- Verify both success and error scenarios
- Ensure scope-based claim filtering is tested
- Report gaps with specific spec section references
Basic Requirements
| Check |
Requirement |
Spec Reference |
| [ ] |
Accept access token via Authorization header (Bearer) |
OIDC Core 5.3.1 |
| [ ] |
Support GET method |
OIDC Core 5.3.1 |
| [ ] |
Support POST method |
OIDC Core 5.3.1 |
| [ ] |
Return sub claim (REQUIRED) |
OIDC Core 5.3.2 |
| [ ] |
sub matches ID Token sub |
OIDC Core 5.3.2 |
| [ ] |
Return claims based on granted scopes |
OIDC Core 5.4 |
Request Format
GET Request
GET /userinfo HTTP/1.1
Host: server.example.com
Authorization: Bearer SlAV32hkKG
POST Request
POST /userinfo HTTP/1.1
Host: server.example.com
Authorization: Bearer SlAV32hkKG
Content-Type: application/x-www-form-urlencoded
Response Format
JSON Response (Default)
HTTP/1.1 200 OK
Content-Type: application/json
{
"sub": "248289761001",
"name": "Jane Doe",
"given_name": "Jane",
"family_name": "Doe",
"email": "janedoe@example.com",
"email_verified": true,
"picture": "http://example.com/janedoe/me.jpg"
}
Signed Response (JWT)
| Check |
Requirement |
Spec Reference |
| [ ] |
Support RS256 signed response when requested |
OIDC Core 5.3.2 |
| [ ] |
Honor userinfo_signed_response_alg registration |
OIDC Core 5.3.2 |
Subject Identifier Consistency
| Check |
Requirement |
Spec Reference |
| [ ] |
sub claim MUST be present |
OIDC Core 5.3.2 |
| [ ] |
sub value MUST match ID Token sub |
OIDC Core 5.3.2 |
| [ ] |
sub is stable for the user |
OIDC Core 5.3.2 |
Access Token Validation
| Check |
Requirement |
Spec Reference |
| [ ] |
Validate access token |
OIDC Core 5.3.1 |
| [ ] |
Return 401 for invalid/expired token |
RFC 6750 |
| [ ] |
Return 403 for insufficient scope |
RFC 6750 |
Error Response
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token",
error_description="The access token expired"
Test Case Categories
Access Token Tests
HTTP Method Tests
Sub Claim Tests
Scope-Based Claims Tests
Signed Response Tests (Optional)
Scope to Claims Mapping
| Scope |
Claims |
openid |
sub |
profile |
name, family_name, given_name, middle_name, nickname, preferred_username, profile, picture, website, gender, birthdate, zoneinfo, locale, updated_at |
email |
email, email_verified |
address |
address |
phone |
phone_number, phone_number_verified |
Error Responses
| Condition |
HTTP Status |
WWW-Authenticate |
| Missing token |
401 |
Bearer |
| Invalid token |
401 |
Bearer error="invalid_token" |
| Expired token |
401 |
Bearer error="invalid_token" |
| Insufficient scope |
403 |
Bearer error="insufficient_scope" |
Conformance Test IDs
| Test ID |
Feature |
| OP-UserInfo-Endpoint |
Basic UserInfo functionality |
| OP-UserInfo-RS256 |
Signed UserInfo response |
| OP-UserInfo-Header |
Bearer token in header |
Review Output Format
## Test Case: [Name]
### Target Feature: UserInfo Endpoint - [specific aspect]
### Test ID: OP-UserInfo-[xxx]
### Spec Compliance:
- [x] Covers required behavior per [spec section]
- [ ] Missing: [specific requirement]
### Sub Consistency:
- [x/blank] sub matches ID Token
### Verdict: PASS / FAIL / PARTIAL
### Recommendations: [if any]
Source: maronnjapan/maronn-openid-provider — distributed by TomeVault.
1---2name: userinfo-endpoint-reviewer3description: Review test cases for UserInfo Endpoint. Covers access token validation, Bearer token handling, sub claim consistency, scope-based claims, and signed responses per OIDC Core 1.0 Section 5.3. Use when this capability is needed.4---56# UserInfo Endpoint Test Case Reviewer78Review test cases for UserInfo Endpoint in OpenID Connect Basic OP.910## Scope1112- **Feature**: UserInfo Endpoint13- **Specifications**: OIDC Core 1.0 Section 5.3, 5.414- **Profile**: Basic OP1516## Review Process17181. Identify which UserInfo requirement the test targets192. Check against the checklist below203. Verify both success and error scenarios214. Ensure scope-based claim filtering is tested225. Report gaps with specific spec section references2324## Basic Requirements2526| Check | Requirement | Spec Reference |27|-------|-------------|----------------|28| [ ] | Accept access token via Authorization header (Bearer) | OIDC Core 5.3.1 |29| [ ] | Support GET method | OIDC Core 5.3.1 |30| [ ] | Support POST method | OIDC Core 5.3.1 |31| [ ] | Return `sub` claim (REQUIRED) | OIDC Core 5.3.2 |32| [ ] | `sub` matches ID Token `sub` | OIDC Core 5.3.2 |33| [ ] | Return claims based on granted scopes | OIDC Core 5.4 |3435## Request Format3637### GET Request3839```http40GET /userinfo HTTP/1.141Host: server.example.com42Authorization: Bearer SlAV32hkKG43```4445### POST Request4647```http48POST /userinfo HTTP/1.149Host: server.example.com50Authorization: Bearer SlAV32hkKG51Content-Type: application/x-www-form-urlencoded52```5354## Response Format5556### JSON Response (Default)5758```http59HTTP/1.1 200 OK60Content-Type: application/json6162{63 "sub": "248289761001",64 "name": "Jane Doe",65 "given_name": "Jane",66 "family_name": "Doe",67 "email": "janedoe@example.com",68 "email_verified": true,69 "picture": "http://example.com/janedoe/me.jpg"70}71```7273### Signed Response (JWT)7475| Check | Requirement | Spec Reference |76|-------|-------------|----------------|77| [ ] | Support RS256 signed response when requested | OIDC Core 5.3.2 |78| [ ] | Honor `userinfo_signed_response_alg` registration | OIDC Core 5.3.2 |7980## Subject Identifier Consistency8182| Check | Requirement | Spec Reference |83|-------|-------------|----------------|84| [ ] | `sub` claim MUST be present | OIDC Core 5.3.2 |85| [ ] | `sub` value MUST match ID Token `sub` | OIDC Core 5.3.2 |86| [ ] | `sub` is stable for the user | OIDC Core 5.3.2 |8788## Access Token Validation8990| Check | Requirement | Spec Reference |91|-------|-------------|----------------|92| [ ] | Validate access token | OIDC Core 5.3.1 |93| [ ] | Return 401 for invalid/expired token | RFC 6750 |94| [ ] | Return 403 for insufficient scope | RFC 6750 |9596### Error Response9798```http99HTTP/1.1 401 Unauthorized100WWW-Authenticate: Bearer error="invalid_token",101 error_description="The access token expired"102```103104## Test Case Categories105106### Access Token Tests107108- [ ] Valid: Bearer token in Authorization header109- [ ] Invalid: Missing Authorization header110- [ ] Invalid: Expired access token111- [ ] Invalid: Revoked access token112- [ ] Invalid: Malformed token113114### HTTP Method Tests115116- [ ] Valid: GET request with Bearer token117- [ ] Valid: POST request with Bearer token118- [ ] Invalid: Other HTTP methods (PUT, DELETE, etc.)119120### Sub Claim Tests121122- [ ] Valid: `sub` present in response123- [ ] Valid: `sub` matches ID Token `sub`124- [ ] Invalid: `sub` missing from response125126### Scope-Based Claims Tests127128- [ ] Valid: Only requested scope claims returned129- [ ] Valid: `openid` scope returns `sub` only130- [ ] Valid: `profile` scope returns profile claims131- [ ] Valid: `email` scope returns email claims132- [ ] Valid: `phone` scope returns phone claims133- [ ] Valid: `address` scope returns address claim134135### Signed Response Tests (Optional)136137- [ ] Valid: RS256 signed JWT response138- [ ] Valid: Signature verifiable with OP's key139- [ ] Valid: Honors registered `userinfo_signed_response_alg`140141## Scope to Claims Mapping142143| Scope | Claims |144|-------|--------|145| `openid` | `sub` |146| `profile` | `name`, `family_name`, `given_name`, `middle_name`, `nickname`, `preferred_username`, `profile`, `picture`, `website`, `gender`, `birthdate`, `zoneinfo`, `locale`, `updated_at` |147| `email` | `email`, `email_verified` |148| `address` | `address` |149| `phone` | `phone_number`, `phone_number_verified` |150151## Error Responses152153| Condition | HTTP Status | WWW-Authenticate |154|-----------|-------------|------------------|155| Missing token | 401 | `Bearer` |156| Invalid token | 401 | `Bearer error="invalid_token"` |157| Expired token | 401 | `Bearer error="invalid_token"` |158| Insufficient scope | 403 | `Bearer error="insufficient_scope"` |159160## Conformance Test IDs161162| Test ID | Feature |163|---------|---------|164| OP-UserInfo-Endpoint | Basic UserInfo functionality |165| OP-UserInfo-RS256 | Signed UserInfo response |166| OP-UserInfo-Header | Bearer token in header |167168## Review Output Format169170```171## Test Case: [Name]172### Target Feature: UserInfo Endpoint - [specific aspect]173### Test ID: OP-UserInfo-[xxx]174### Spec Compliance:175- [x] Covers required behavior per [spec section]176- [ ] Missing: [specific requirement]177### Sub Consistency:178- [x/blank] sub matches ID Token179### Verdict: PASS / FAIL / PARTIAL180### Recommendations: [if any]181```182183---184> Source: [maronnjapan/maronn-openid-provider](https://github.com/maronnjapan/maronn-openid-provider) — distributed by [TomeVault](https://tomevault.io).185<!-- tomevault:4.0:skill_md:2026-06-14 -->
tomevault-io