Conformance test tool
The Conformance Test Tool (CTT) enables users to perform automated tests on their API services. To be allowed to join the production environment of the iSHARE Network, parties will need to pass all test cases that apply to their role in the iSHARE Network. The CTT will show you, per test case, whether you passed or failed the case.
To be able to join the iSHARE network in the production environment, you are required to pass a full test run for your specific role in the network. If you have passed the test run for your specific role, please notify us (https://ishare.eu/home/contact/) with the identifier of your test run.
Portal
Users can log in to the CTT at the admin portal and run a set of test cases on their API services. In order to log in, please request an account. Key functionalities that users of the Conformance Test Tool can perform:
Run the full test run for a specific role in the iSHARE Framework (i.e. Service Provider or Authorisation Registry) on your API services;
Run a test run on your specific API Service (i.e. /token or /delegation);
Run a specific test case on your API Service.
After logging in to the Conformance Test Tool, users will be able to configure the endpoints of their API services and will be able to run the test cases on the API services themselves. After a test run completes, users will receive the results of the test run in the CTT. The results will display if you have passed the tests, or if not, which test cases failed, and why. The user interface is made in such a way that it will be easy to understand for anyone what test cases have passed and failed, and why. However, some test cases consist of multiple steps, so in order to understand which exact step has failed, detailed logs are needed. CTT provides raw JSON step-by-step dumps for completed test runs, but those logs might be too technical for business people or non-technical IT specialists to read. If your service fails at least one test case, it is not yet conforming to the iSHARE standards as specified in the scheme and on the developer portal.
Test Case Specifications
The API services that need to conform to iSHARE standards differ per party role in the iSHARE Network. Different roles in the iSHARE Network require different sets of test cases, as is detailed below. Below is only a list of required endpoints; the full list of test cases per API service can be found on the CTT test cases page.
Service Consumers
The Service Consumer does not necessarily host API services. The only requirement is to be able to get a valid access token from the Participant Registry.
Service Providers
The /token endpoint MUST conform to the iSHARE standards;
The /capabilities endpoint MUST conform to the iSHARE standards.
Authorisation Registries
The /token endpoint MUST conform to the iSHARE standards;
The /capabilities endpoint MUST conform to the iSHARE standards;
The /delegation endpoint MUST conform to the iSHARE standards. For proper testing of this endpoint, users SHOULD provide two valid delegation requests: one that returns a “Permit” when requested, and one that returns a “Deny” when requested.
If you want to test your delegation endpoint, it is necessary to add Test Service Consumer 1’s ID (did:ishare:EU.NL.NTRNL-10000001) in some test-policy. This delegation will be tested during conformance testing.
Identity Providers
The /capabilities endpoint MUST conform to the iSHARE standards;
The /authorise endpoint MUST conform to the iSHARE standards. For proper testing of this endpoint, users SHOULD provide an error endpoint to which users will be redirected on invalid authorize requests.
The /token endpoints (both M2M and H2M) MUST be conforming to the iSHARE standards;
The /userinfo endpoint MUST conform to the iSHARE standards. For proper testing of this endpoint, users SHOULD provide two valid delegation requests: one that returns a “Permit” when requested, and one that returns a “Deny” when requested.
For proper testing of IdP endpoints, users SHOULD provide a login endpoint towards which human authentication requests will be sent. In addition, users should also provide username and password HTTP request body parameter names that their API expects, with existing human user credentials that are going to simulate the login.
Delegations testing
An important aspect of testing an Authorisation Registry is testing the /delegations endpoint. To be able to do this testing, it is necessary that the Conformance Test Tool can retrieve a ‘dummy’ delegation. Users can enter two delegation masks in the Conformance Test Tool:
A Permit Mask: This is a delegation mask that should resolve to “Permit” when used in a delegation request
A Deny Mask: This is a delegation mask that should resolve to “Deny” when used in a delegation request
The Conformance Test Tool does multiple ‘valid requests’ to ensure that the implementation is correct. For example, one test case does a delegation request as if the request is done by the ‘accessSubject’ of the delegation mask. Another test case does a delegation request as if the request is done by a Service Provider from the ‘environment’ of the delegation mask. This requires the use of the ‘previous_steps’ field (see iSHARE Authorisation). For these delegation requests to work, it is important to know the following:
The ‘accessSubject’ in the delegation mask needs to be ‘
did:ishare:EU.NL.NTRNL-10000001’The ‘environment’ in the delegation mask needs to contain the Service Provider.
did:ishare:EU.NL.NTRNL-10000003’A ‘client_assertion’ from ‘
did:ishare:EU.NL.NTRNL-10000001’ to ‘did:ishare:EU.NL.NTRNL10000003’ is included in ‘previous_steps’ in the delegation request when the request is done by ‘did:ishare:EU.NL.NTRNL-10000003’
Below you can see an example of the body of such a request.
What is next?
After verifying compatibility:
In general, you follow the steps listed below. Kindly refer to the admission process at https://framework.ishare.eu/is/admission, which is leading
Apply for an appropriate signing certificate with an authorised Certificate Authority which is in the trusted list. Please note that the application may take some time. For general non-binding guidance, please refer to https://github.com/iSHAREScheme/eSEALsGuide and feel free to contribute your learnings to the same.
Install the certificate on your server
Register certificate with Participant Registry
Sign Accession Agreement
For Certified Roles: provide a signed Assessment Framework for Certified Parties
Last updated