Add initial conformance tests for Resource AS of EMA

[tnorimat]

Background

There is no conformance test for IdP AS and Resource AS of Enterprise-Managed Authorization. The issue is for adding conformance test for Resource AS of EMA

Strategy

The conformance test will be implemented in step-by-step.
Firstly, lay the groundwork for implementing this test and implement some positive and negative tests based on that.
Next, implement all tests covering EMA's requirements for Resource AS.

Scope

• The issue targets Resource AS. IdP AS will be covered by other issue.
• Implement some positive and negative tests, not cover all EMS's requirements. The comprehensive testing will be covered by other issue.

Specification References

• Enterprise-Managed Authorization
• Internet-Draft v4: Identity Assertion JWT Authorization Grant
• RFC 7521: Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants
• RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants

Approach

• The test runs in localhost.
• The test runner simulates MCP Client.
• The test runner prepares and controlls two entities: Trusted IdP AS and Untrusted IdP AS.
• Trusted IdP AS and Untrusted IdP AS can provide the test runner with ID-JAG as it wants (not only valid one but also invalid one).
• The test runner provide two endpoint of Trusted IdP AS: sever metadata endpoint (well-known URI) and JWK Set Endpoint (jwks_uri).
• The server metadata endpoint provides a target Resource AS with jwks_uri.
• The JWK Set Endpoint provides a target Resource AS with the key for verifying signature of ID-JAG.
• On running a test scenario, the test runner as MCP Client sends JWT authorization grant with ID-JAG to the target Resource AS.
• When receiving the response from the target Resource AS, the test runner judges if the test scenario successfully completes or not.

sequenceDiagram
    autonumber
    participant Client as MCP Client<br/>(test runner)
    participant RAS as Resource AS<br/>(test target)
    participant IdP as Trusted IdP AS<br/>(test runner)

    Note over Client,IdP: Create ID-JAG
    Note over Client: Resource AS Issuer URL -> well-known URI
    Client->>RAS: Request (well-known URI): GET server metadata
    RAS-->>Client: Response: server metadata (token endpoint, introspection endpoint)

    Client->>RAS: Request (Token Endpoint): JWT Authorization Grant w/ ID-JAG
    Note over RAS: Verify Request
    Note over RAS: Verify ID-JAG is valid format
    Note over RAS: Verify if iss in ID-JAG is trusted IdP AS's Issuer URL
    Note over RAS: ID-JAG -> iss -> well-known URI

    RAS->>IdP: Request (well-known URI): GET server metadata
    IdP-->>RAS: Response: server metadata (jwks_uri)

    RAS->>IdP: Request (jwks_uri): GET JWKS Set
    IdP-->>RAS: Response: JWKS Set

    Note over RAS: Verify ID-JAG signature
    Note over RAS: Verify ID-JAG: EMA, ID-JAG, RFC 7521, RFC 7523, RFC 6749 specs
    RAS-->>Client: Response: JWT Authorization Grant w/ access token

    Note over Client: Verify Response
    Client->>RAS: Request (Introspection Endpoint): POST introspect w/ access token
    RAS-->>Client: Response: JSON document of the access token contents
    Note over Client: Verify access token contents

Loading