Andreas Åkre Solberg Roland Hedberg UNINETT AS Univ. UmeåFederation Lab and OpenID ConnectNorduNet ConferenceOslo, Norway, September 2012
Federation Lab✤ Identity toolkit for testing, validation and debugging of Identity Software.✤ Automated testing tool for increasing interoperability between providers and consumers with SAML and OpenID Connect.✤ A GÉANT project (GN3 JRA3T2) in collaboration with Kantara Initiative and the OpenID community. OpenID Testing Commercial (Kantara Intitive) <-> Research and HE (GEANT) Established (SAML) <-> Emerging (OIC) Nordic collaboration (UNINETT and umu.se) Involved in standardization A very important reference implementation
Complex End-to-end SystemsMany implementations This is a good thing!Many deploymentsVariying spec interpretion Really difficultSub-set implementations to avoid thisInterop issuesThings stop working for end users.Who to blame? Who can ﬁx it?! - difﬁcult questionThings continues to not workUnhappy users We MUST avoid this, but how?
What causes interop issues✤ Flexibility, too many options. Sub-set implementations.✤ Deployment options✤ Yet to be discovered software bugs✤ Unclear speciﬁcation✤ Poor error handling✤ Lack of feature negotiation or limited language (metadata) of expressing supported features
Postel’s Law «Be strict in what you send, but generous in what you receive» Postels Law,1981, RFC793: TCP✤ Will this increase interop?✤ Interop issues less likely to be detected, and may easily pass matrix testing.
Typical Matrix TestingTest 4-5 products against each otherValidate that it is possible to conﬁgure theproducts to work with each other.Product is certiﬁed.Does not really ensure interop in an actualdeployment.
ProﬁlingBy being very excplitit on how to use theprotocols, interoperability increases.saml2int
Automated Testing of SAML and OpenID ConnectThis is what we did with Federation LabAn automated client, simulates one entity whiles test the other.Consumer <-> ProviderPerforms about 100 different test ﬂows, and focus ondiscovering things that goes wrong, rather than verifying thatthings may work. Real time testing with detailed feedback Test each provider, and present results. for debugging.
Federation Lab contains a set of useful debugging tools for encoding anddecoding messages.
Automated testing of SAML Service Providers performs approx 80 testruns with various legal and illegal message ﬂows to verify behaviour ofsoftware.
Automated testing of OpenID Connect Providers tests providers, andinvolves an innovative engine for working with human user interactionwith login screens.