| Criterion | Status | Description | Data Received | Comment | Date/Time |
|---|
| Overall | INCOMPLETE | Overall Test Result | | First test: 2023-03-01 12:12:18-0800 Last test: 2023-03-01 12:12:19-0800 | |
| IB | INCOMPLETE | Client Authentication | | | |
| IB2 | INCOMPLETE | client must be registered | | | |
| IB2a | NOT TESTED | registered using DCR | | | |
| IB2b | NOT TESTED | use correct client_id | | | |
| IB3 | PASS | authorization_code flow | | | |
| IB3a | PASS | use authz endpoint | https://test.udap.org/oauth/stage/authz | | 2023-03-01 12:12:18-0800 |
| IB3b | PASS | authz has required params | | | |
| IB3b1 | PASS | response_type | code | | 2023-03-01 12:12:18-0800 |
| IB3b2 | PASS | state | iVsjS4Gs_cXlAg7mLuuUc7Sm6JrH25yqE1qyeDqzd-0 | | 2023-03-01 12:12:19-0800 |
| IB3b3 | PASS | client_id | 322b9acd-e7ed-4a7e-bcf2-6587b96d8fee | | 2023-03-01 12:12:18-0800 |
| IB3b4 | PASS | scope | [openid] | | 2023-03-01 12:12:19-0800 |
| INFO | | [openid] | list of allowed scopes | 2023-03-01 12:12:19-0800 |
| IB3b5 | PASS | redirect_uri | | | |
| IB3b5a | PASS | redirect URI is absolute | https://fhirlabs-udaped-v46zp6zteq-uw.a.run.app/udapBusinessToBusiness | | 2023-03-01 12:12:18-0800 |
| IB3b5b | PASS | redirect URI is https | | | 2023-03-01 12:12:18-0800 |
| IB3b5c | PASS | redirect URI is preregistered | | | 2023-03-01 12:12:18-0800 |
| IB4 | INCOMPLETE | prepare Authentication Token | | | |
| IB4a | INCOMPLETE | AnT has required headers | | | |
| IB4a1 | NOT TESTED | alg | | | |
| IB4a2 | INCOMPLETE | x5c | | | |
| IB4a2a | NOT TESTED | x5c leaf cert | | | |
| IB4b | INCOMPLETE | AnT has required claims | | | |
| IB4b1 | NOT TESTED | iss | | | |
| IB4b2 | NOT TESTED | sub | | | |
| IB4b3 | NOT TESTED | aud | | | |
| IB4b4 | NOT TESTED | exp | | | |
| IB4b5 | NOT TESTED | iat | | | |
| IB4b6 | NOT TESTED | jti | | | |
| IB4c | NOT TESTED | AnT signature and serialization | | | |
| IB5 | INCOMPLETE | make POST request to token endpoint | | | |
| IB5a | INCOMPLETE | token request has required headers | | | |
| IB5a1 | NOT TESTED | token request content-type | | | |
| IB5a2 | NOT TESTED | token request no basic auth | | | |
| IB5b | INCOMPLETE | token request has required body params | | | |
| IB5b1 | NOT TESTED | grant_type | | | |
| IB5b2 | NOT TESTED | client_assertion_type | | | |
| IB5b3 | NOT TESTED | client_assertion | | | |
| IB5b4 | NOT TESTED | udap | | | |
| IB5b5 | NOT TESTED | client_id | | | |
| IB5b6 | NOT TESTED | code | | | |
| IB5b7 | NOT TESTED | refresh_token | | | |
| IB5b8 | NOT TESTED | scope | | | |
