AssertionManagerGui

Id scheme	Assertion id	Status	Testable?	#Coverage	#Applies to	Predicate	Page	Tags	Last changed
1 2 3
ITI103	ITI103-001	to be reviewed	Testable	0	0	The client issues a HTTP GET request to the well-known metadata endpoint associated with Authorization Server.	19	Section 3.103.4.1.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-002	to be reviewed	Testable	0	0	There are various ways of formulating this endpoint as described in [RFC8414, section 3.1], and [OpenID Connect Discovery, section 4]. Authorization Servers are recommended to follow one of these procedures, but may choose a different well-known endpoint location mechanism.	19	Section 3.103.4.1.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-003	to be reviewed	Testable	0	0	Upon receiving a metadata request, the Authorization Server should respond with the metadata document as described in ITI TF-2: 3.103.4.2.	19	Section 3.103.4.1.3	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-004	to be reviewed	Testable	0	0	Implementations supporting multi-tenancy shall respond with different metadata documents for different tenants, providing at least a different issuer value.	19	Section 3.103.4.1.3	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-005	to be reviewed	Testable	0	0	Requests for metadata for non-existing tenants shall result in a HTTP 404 (not found) response.	19	Section 3.103.4.1.3	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-006	to be reviewed	Testable	0	0	The response shall be structured as a plain JSON document.	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-007	to be reviewed	Testable	0	0	The document shall be structured according to the rules set forth in [RFC8414, Section 2].	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-008	to be reviewed	Testable	0	0	The issuer URL shall use the "https" scheme.	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-009	to be reviewed	Testable	0	0	The issuer URL shall contain the domain name of the URL at which the metadata document can be retrieved.	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-010	to be reviewed	Testable	0	0	The issuer URL shall contain any path elements referring to a tenant.	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-011	to be reviewed	Testable	0	0	Other path elements of the issuer URL, such as those referring to the document location should be omitted.	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-012	to be reviewed	Testable	0	0	Authorization Server's "authorization_endpoint" is mandatory.	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-013	to be reviewed	Testable	0	0	Authorization Server's "token_endpoint" is mandatory.	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-014	to be reviewed	Testable	0	0	An Authorization Server that supports the JWT Token or SAML Token Options shall provide "jwks_uri" claim to communicate the public keys that can be used to verify JWT token or SAML token signatures.	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-015	to be reviewed	Testable	0	0	The list of scopes supported by the Authorization Server may be present.	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-016	to be reviewed	Testable	0	0	Authorization Servers may opt to publish a subset of the scopes usable.	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-017	to be reviewed	Testable	0	0	response_types_supported is required	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-018	to be reviewed	Testable	0	0	As the implicit grant flow is not supported in OAuth2.1, the response types should not include the value "token".	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-019	to be reviewed	Testable	0	0	Authorization Servers shall include the response type "code".	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman
ITI103	ITI103-020	to be reviewed	Testable	0	0	Authorization Servers supporting [OpenId Connect] or other standards may include other token types, such as "id_token".	20	Section 3.103.4.2.2	6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-001

to be reviewed

Testable

0

The client issues a HTTP GET request to the well-known metadata endpoint associated with Authorization Server.

19

Section 3.103.4.1.2

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-002

to be reviewed

Testable

0

There are various ways of formulating this endpoint as described in [RFC8414, section 3.1], and [OpenID Connect Discovery, section 4]. Authorization Servers are recommended to follow one of these procedures, but may choose a different well-known endpoint location mechanism.

19

Section 3.103.4.1.2

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-003

to be reviewed

Testable

0

Upon receiving a metadata request, the Authorization Server should respond with the metadata document as described in ITI TF-2: 3.103.4.2.

19

Section 3.103.4.1.3

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-004

to be reviewed

Testable

0

Implementations supporting multi-tenancy shall respond with different metadata documents for different tenants, providing at least a different issuer value.

19

Section 3.103.4.1.3

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-005

to be reviewed

Testable

0

Requests for metadata for non-existing tenants shall result in a HTTP 404 (not found) response.

19

Section 3.103.4.1.3

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-006

to be reviewed

Testable

0

The response shall be structured as a plain JSON document.

20

Section 3.103.4.2.2

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-007

to be reviewed

Testable

0

The document shall be structured according to the rules set forth in [RFC8414, Section 2].

20

Section 3.103.4.2.2

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-008

to be reviewed

Testable

0

The issuer URL shall use the "https" scheme.

20

Section 3.103.4.2.2

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-009

to be reviewed

Testable

0

The issuer URL shall contain the domain name of the URL at which the metadata document can be retrieved.

20

Section 3.103.4.2.2

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-010

to be reviewed

Testable

0

The issuer URL shall contain any path elements referring to a tenant.

20

Section 3.103.4.2.2

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-011

to be reviewed

Testable

0

Other path elements of the issuer URL, such as those referring to the document location should be omitted.

20

Section 3.103.4.2.2

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-012

to be reviewed

Testable

0

Authorization Server's "authorization_endpoint" is mandatory.

20

Section 3.103.4.2.2

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-013

to be reviewed

Testable

0

Authorization Server's "token_endpoint" is mandatory.

20

Section 3.103.4.2.2

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-014

to be reviewed

Testable

0

An Authorization Server that supports the JWT Token or SAML Token Options shall provide "jwks_uri" claim to communicate the public keys that can be used to verify JWT token or SAML token signatures.

20

Section 3.103.4.2.2

6/27/22 3:54:39 PM by vhofman

ITI103

ITI103-015

to be reviewed

Testable

0

The list of scopes supported by the Authorization Server may be present.

20

Section 3.103.4.2.2

6/27/22 3:54:39 PM by vhofman