< Return to Summary | File Generated: Tue Apr 16 2024 11:54:39 GMT+0000 (Coordinated Universal Time)

booking-partner-authentication >> authorization-persisted

Booking Flow:

Opportunity Type:

Feature: Authentication / Booking Partner Authentication for Multiple Seller Systems (Implemented)

Test: Authorization persists when not requesting offline access

When authorisation is requested without offline access and a user has already given permission, consent must not be required.

Running only this test

npm start -- --runInBand test/features/authentication/booking-partner-authentication/implemented/authorization-persisted-test.js

Is this test failing?

The OpenActive Reference Implementation test result for this test can be used as a reference to help with debugging.


✅ 9 passed with 0 failures, 0 warnings and 0 suggestions


✅ Open ID Connect Authentication

Credentials

The test suite is using the credentials configured by bookingPartnersForSpecificTests.authorizationPersisted.authentication.clientCredentials for this test:

Discovery Request

GET https://localhost:5003/.well-known/openid-configuration


Response status code: 200.

{
  "issuer": "https://localhost:5003",
  "jwks_uri": "https://localhost:5003/.well-known/openid-configuration/jwks",
  "authorization_endpoint": "https://localhost:5003/connect/authorize",
  "token_endpoint": "https://localhost:5003/connect/token",
  "userinfo_endpoint": "https://localhost:5003/connect/userinfo",
  "end_session_endpoint": "https://localhost:5003/connect/endsession",
  "check_session_iframe": "https://localhost:5003/connect/checksession",
  "revocation_endpoint": "https://localhost:5003/connect/revocation",
  "introspection_endpoint": "https://localhost:5003/connect/introspect",
  "device_authorization_endpoint": "https://localhost:5003/connect/deviceauthorization",
  "frontchannel_logout_supported": true,
  "frontchannel_logout_session_supported": true,
  "backchannel_logout_supported": true,
  "backchannel_logout_session_supported": true,
  "scopes_supported": [
    "openid",
    "openactive-identity",
    "openactive-openbooking",
    "openactive-ordersfeed",
    "offline_access"
  ],
  "claims_supported": [
    "sub",
    "https://openactive.io/sellerId",
    "https://openactive.io/sellerName",
    "https://openactive.io/sellerUrl",
    "https://openactive.io/sellerLogo",
    "https://openactive.io/bookingServiceName",
    "https://openactive.io/bookingServiceUrl",
    "name",
    "https://openactive.io/clientId"
  ],
  "grant_types_supported": [
    "authorization_code",
    "client_credentials",
    "refresh_token",
    "implicit",
    "urn:ietf:params:oauth:grant-type:device_code"
  ],
  "response_types_supported": [
    "code",
    "token",
    "id_token",
    "id_token token",
    "code id_token",
    "code token",
    "code id_token token"
  ],
  "response_modes_supported": [
    "form_post",
    "query",
    "fragment"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "subject_types_supported": [
    "public"
  ],
  "code_challenge_methods_supported": [
    "plain",
    "S256"
  ],
  "request_parameter_supported": true,
  "registration_endpoint": "https://localhost:5003/connect/register"
}

Authorization Code Flow (first attempt) - 1 Request

POST http://localhost:3000/browser-automation-for-auth

{
  "headless": true,
  "offlineAccess": true,
  "username": "test1",
  "password": "test1",
  "authorizationUrl": "https://localhost:5003/connect/authorize?client_id=clientid_801&scope=openid%20openactive-identity&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcb&code_challenge=8H1ONgltyZZllLWkM6MlbZtsRXtSuihjZ_2tVFH3ehU&code_challenge_method=S256"
}

Screenshot: Login page

"https://localhost:5003/Account/Login?ReturnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3Dclientid_801%26scope%3Dopenid%2520openactive-identity%26response_type%3Dcode%26redirect_uri%3Dhttp%253A%252F%252Flocalhost%253A3000%252Fcb%26code_challenge%3D8H1ONgltyZZllLWkM6MlbZtsRXtSuihjZ_2tVFH3ehU%26code_challenge_method%3DS256"

Screenshot: Login page

Screenshot: Authorization page

"https://localhost:5003/consent?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3Dclientid_801%26scope%3Dopenid%2520openactive-identity%26response_type%3Dcode%26redirect_uri%3Dhttp%253A%252F%252Flocalhost%253A3000%252Fcb%26code_challenge%3D8H1ONgltyZZllLWkM6MlbZtsRXtSuihjZ_2tVFH3ehU%26code_challenge_method%3DS256"

Screenshot: Authorization page

Callback URL

"/cb?code=EA8ACABE2AC1230D01014C35438A1B453DBBB6C9F5D6829C6021857C0BD1C08B&scope=openid%20openactive-identity&session_state=O4owDIKc_LE4I8B33DS7KstmNdpxdFHi78AK5G7uT9k.EB495D9462DB906503F5D81B323FA8DA"

Authorization Code Flow (first attempt) - 2 Request

POST https://localhost:5003/connect/token

"grant_type=authorization_code&code=EA8ACABE2AC1230D01014C35438A1B453DBBB6C9F5D6829C6021857C0BD1C08B&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcb&code_verifier=jZedmeWa9Enavn3Ua56BuNxVw8zQXX0TCmLzRGAUya0"

Response status code: 200.

{
  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IkIwNEY3QjkxREUzQjk0NzhDNjE4MzNGQjI0QUE1Q0RCIiwidHlwIjoiSldUIn0.eyJuYmYiOjE3MTMyNjg0ODEsImV4cCI6MTcxMzI2ODc4MSwiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6NTAwMyIsImF1ZCI6ImNsaWVudGlkXzgwMSIsImlhdCI6MTcxMzI2ODQ4MSwiYXRfaGFzaCI6IlhwSlN2MjJoMWZaTFJORHN0V2VUdVEiLCJzaWQiOiJCN0ZBOUE3RTMzNTQ2MUZCNzdBMDIwMTk2QTA5QUNDMCIsInN1YiI6IjEwMCIsImF1dGhfdGltZSI6MTcxMzI2ODQ4MCwiaWRwIjoibG9jYWwiLCJodHRwczovL29wZW5hY3RpdmUuaW8vc2VsbGVyTmFtZSI6IkFjbWUgRml0bmVzcyBMdGQiLCJodHRwczovL29wZW5hY3RpdmUuaW8vc2VsbGVySWQiOiJodHRwczovL2xvY2FsaG9zdDo1MDAxL2FwaS9pZGVudGlmaWVycy9zZWxsZXJzLzEiLCJodHRwczovL29wZW5hY3RpdmUuaW8vc2VsbGVyVXJsIjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5jb20iLCJodHRwczovL29wZW5hY3RpdmUuaW8vc2VsbGVyTG9nbyI6Imh0dHBzOi8vcGxhY2VraXR0ZW4uY29tLzY0MC8zNjAiLCJhbXIiOlsicHdkIl19.NUbfW-3NbwDXVVrhhQZTbfcxv7QYe6qF2Ug4-0L53cudj4P60LEqATEHiyfXTDmWe2_QpRwgs78QMft6zzUkJslT4Uf3Tm8wI5Bk0gQrNTLZCKnoUgDvQ6G4Y7Bnz14UlJYKgpiaJBEvZSezR0oYbCNNuZg_cT-e27WikXROgMn_3oJEP-5BagHKxTpKJVtGnRbqMPCOr8JqxCt1z4EerJuyQyApWoULst7-uQ6My4-5VoIWa3effUlZ39Cb13Q3ZUW0vUO8a2EaNZazEV6krtil183v3UQJDwD8JSy19Hx-c71Bs6w9ZWuTZwFrx7Z9AGnxLUsnrx4PnYlLzgC1MA",
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IkIwNEY3QjkxREUzQjk0NzhDNjE4MzNGQjI0QUE1Q0RCIiwidHlwIjoiYXQrand0In0.eyJuYmYiOjE3MTMyNjg0ODEsImV4cCI6MTcxMzI3MjA4MSwiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6NTAwMyIsImNsaWVudF9pZCI6ImNsaWVudGlkXzgwMSIsImh0dHBzOi8vb3BlbmFjdGl2ZS5pby9jbGllbnRJZCI6ImNsaWVudGlkXzgwMSIsInN1YiI6IjEwMCIsImF1dGhfdGltZSI6MTcxMzI2ODQ4MCwiaWRwIjoibG9jYWwiLCJqdGkiOiJEODY2QzYwRkYzNjZFQkE1NTlFRTZDQ0M3NjU5OUZCQyIsInNpZCI6IkI3RkE5QTdFMzM1NDYxRkI3N0EwMjAxOTZBMDlBQ0MwIiwiaWF0IjoxNzEzMjY4NDgxLCJzY29wZSI6WyJvcGVuaWQiLCJvcGVuYWN0aXZlLWlkZW50aXR5Il0sImFtciI6WyJwd2QiXX0.weRw4UuF2V7TueL6rTETN8fuYGL7QxVTjyOer0ipHsBOEcNYvS2MYeK08PfvY3VPk1NuWd0j0edee3VYJYn3w11ShD596-63zQe1TLJ_FTpZRTko39FhfcEopQkL5dRj2hanCbCpv_Cj4ETCun8Zuc40JYnxLWSDOZ-mSJn5_ck4Y6WxuINc-kCQxOOuUhl8mXw0NGi7RLyERN600j2n67U7w4s783qPIhpiqL5QubAdGGcF_WQsV-XZbYp3is7z3da5rAi21QSFJyYyAd412O8-U8RzHP_rpsHuJBVgbfPPaf10lCr7EVFY4XbXLT5C_45ZCMcl99s6vK8HDEdBpQ",
  "expires_in": 3600,
  "token_type": "Bearer",
  "scope": "openid openactive-identity"
}

Authorization Code Flow (first attempt) - 3 Request

GET https://localhost:5003/.well-known/openid-configuration/jwks


Response status code: 200.

{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "kid": "B04F7B91DE3B9478C61833FB24AA5CDB",
      "e": "AQAB",
      "n": "yZO68vCGrvfBQ5R1z0DVCRAADOWeF3aLlhOaz1Je1SnmohmmlO-1F1hkRM_4MJtR5aECMxMz-MUW1nBCPmUrH0h_rrdCdDdlk8vTHki0ixK-gO73W2ZscOCZ6L2fZ2Oqz0_I840cnSCv55zpiOk9oGJL9TEsLAWYAIyQheaqZO3BkqImuBFmaLVTckvaZeONjHDQa01rxEjRQByir6oYSZPJy54XuRQJaPuCVNeOW8r0R9rKUQf9nl7tnVvhCsU3q1-UPrs8ZW_kaYXuYQJJMk392jX6XNm6czehIYM-O8Z5eGFdR3WW7IAWYEmqTCxrCRuuKU-EEcKOwksx8gBPgQ",
      "alg": "RS256"
    }
  ]
}

Authorization Code Flow (first attempt) - Claims Result

id_token claims:

{
  "nbf": 1713268481,
  "exp": 1713268781,
  "iss": "https://localhost:5003",
  "aud": "clientid_801",
  "iat": 1713268481,
  "at_hash": "XpJSv22h1fZLRNDstWeTuQ",
  "sid": "B7FA9A7E335461FB77A020196A09ACC0",
  "sub": "100",
  "auth_time": 1713268480,
  "idp": "local",
  "https://openactive.io/sellerName": "Acme Fitness Ltd",
  "https://openactive.io/sellerId": "https://localhost:5001/api/identifiers/sellers/1",
  "https://openactive.io/sellerUrl": "https://www.example.com",
  "https://openactive.io/sellerLogo": "https://placekitten.com/640/360",
  "amr": [
    "pwd"
  ]
}

Authorization Code Flow (second attempt) - 1 Request

POST http://localhost:3000/browser-automation-for-auth

{
  "headless": true,
  "offlineAccess": true,
  "username": "test1",
  "password": "test1",
  "authorizationUrl": "https://localhost:5003/connect/authorize?client_id=clientid_801&scope=openid%20openactive-identity&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcb&code_challenge=A7BQiOyMFrTtkggR6UzTL2-BtVMByXcY3sInQ7siCy0&code_challenge_method=S256"
}

Screenshot: Login page

"https://localhost:5003/Account/Login?ReturnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3Dclientid_801%26scope%3Dopenid%2520openactive-identity%26response_type%3Dcode%26redirect_uri%3Dhttp%253A%252F%252Flocalhost%253A3000%252Fcb%26code_challenge%3DA7BQiOyMFrTtkggR6UzTL2-BtVMByXcY3sInQ7siCy0%26code_challenge_method%3DS256"

Screenshot: Login page

Callback URL

"/cb?code=D4893B13482D04A3E3C589767148D4F21CB775B6FC98FBC7898A5EABC890EF2B&scope=openid%20openactive-identity&session_state=3JzpXW97GRJ2SVxIYqNT5Kh5Zb2alQg1gjHBJlFO3jk.1F583C7329F4B13B5A33F45FE0C515BC"

Authorization Code Flow (second attempt) - 2 Request

POST https://localhost:5003/connect/token

"grant_type=authorization_code&code=D4893B13482D04A3E3C589767148D4F21CB775B6FC98FBC7898A5EABC890EF2B&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcb&code_verifier=5yOL-jCuW7tW180vjvyEeIJQjzKIXvVVJVU07xqLSJc"

Response status code: 200.

{
  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IkIwNEY3QjkxREUzQjk0NzhDNjE4MzNGQjI0QUE1Q0RCIiwidHlwIjoiSldUIn0.eyJuYmYiOjE3MTMyNjg0ODIsImV4cCI6MTcxMzI2ODc4MiwiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6NTAwMyIsImF1ZCI6ImNsaWVudGlkXzgwMSIsImlhdCI6MTcxMzI2ODQ4MiwiYXRfaGFzaCI6ImZ0WEZMckhfUlZDOHVrNE1GSVBqeEEiLCJzaWQiOiI2NDgyMEM4Rjg3ODAyNDBGRjg5NUM4QkYyNTU2MEI3OSIsInN1YiI6IjEwMCIsImF1dGhfdGltZSI6MTcxMzI2ODQ4MiwiaWRwIjoibG9jYWwiLCJodHRwczovL29wZW5hY3RpdmUuaW8vc2VsbGVyTmFtZSI6IkFjbWUgRml0bmVzcyBMdGQiLCJodHRwczovL29wZW5hY3RpdmUuaW8vc2VsbGVySWQiOiJodHRwczovL2xvY2FsaG9zdDo1MDAxL2FwaS9pZGVudGlmaWVycy9zZWxsZXJzLzEiLCJodHRwczovL29wZW5hY3RpdmUuaW8vc2VsbGVyVXJsIjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5jb20iLCJodHRwczovL29wZW5hY3RpdmUuaW8vc2VsbGVyTG9nbyI6Imh0dHBzOi8vcGxhY2VraXR0ZW4uY29tLzY0MC8zNjAiLCJhbXIiOlsicHdkIl19.O1J3V7JJeWXWks1XzTL7L-gutOtI9zjBhjgyQBKKbLt8JmG9_I4TXqk04gec8XL6ulxbC_Yk6L3JCRFeodaDkY_F6nSgLpCWScssw_RDnEg1kbMPzE9C606o3ZmN_5bEydssrJ9874iDoLBLvhDHzn-sDDX4IwCeS2dmfUY_JahyXzKDeCCWkPmYFtMfKgwnk_WP_zN9h4ObluC4B89P2QruyVbGFlW8jqhQoBei-WWYlRKemeNzw0XRs2qJSDcL3CT8NS8RPFGRHETPUQKCfkeqbiC2Z8E2qa2Tjw348fGmy8gvCu3ljqWZx_SjSp3HfW-IoMcewX2yu_3OGASuOg",
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IkIwNEY3QjkxREUzQjk0NzhDNjE4MzNGQjI0QUE1Q0RCIiwidHlwIjoiYXQrand0In0.eyJuYmYiOjE3MTMyNjg0ODIsImV4cCI6MTcxMzI3MjA4MiwiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6NTAwMyIsImNsaWVudF9pZCI6ImNsaWVudGlkXzgwMSIsImh0dHBzOi8vb3BlbmFjdGl2ZS5pby9jbGllbnRJZCI6ImNsaWVudGlkXzgwMSIsInN1YiI6IjEwMCIsImF1dGhfdGltZSI6MTcxMzI2ODQ4MiwiaWRwIjoibG9jYWwiLCJqdGkiOiIxRUEzRjBCREI0RDQ5OEZDNzEyQ0M1Qjk0NEJBOUExRCIsInNpZCI6IjY0ODIwQzhGODc4MDI0MEZGODk1QzhCRjI1NTYwQjc5IiwiaWF0IjoxNzEzMjY4NDgyLCJzY29wZSI6WyJvcGVuaWQiLCJvcGVuYWN0aXZlLWlkZW50aXR5Il0sImFtciI6WyJwd2QiXX0.k9sAAzcIMz6NXCyxOxWwWi50ddElRoO-LoZncexpcIbG8ATDzVrK_bT9ccPzNhK0j8ukCoJzWtHod2FvltibsJY-AtwaPxHn3TaPr7R8KQKGnq3PI19SymEx5R_mt4BwSy8yXUboSZjjzl7FLnKP7gfjEZrWs_GJjFVVYlJIEyc74DkOPraeokkUOiD3soBf6sFSCE7dRuQv6EYHotKXxauaHCAFEfHNJzXh7p_iXnG3QkQUYE0ccCWjA2ldcrUmiqUL3Uy9khF9kSe684NXgKQNj0D6wVW07h8zVExPNxEwsH9oyiZUeZG_OtkyoRwSDX5SM6K6yDInxcNoPB5Stw",
  "expires_in": 3600,
  "token_type": "Bearer",
  "scope": "openid openactive-identity"
}

Authorization Code Flow (second attempt) - Claims Result

id_token claims:

{
  "nbf": 1713268482,
  "exp": 1713268782,
  "iss": "https://localhost:5003",
  "aud": "clientid_801",
  "iat": 1713268482,
  "at_hash": "ftXFLrH_RVC8uk4MFIPjxA",
  "sid": "64820C8F8780240FF895C8BF25560B79",
  "sub": "100",
  "auth_time": 1713268482,
  "idp": "local",
  "https://openactive.io/sellerName": "Acme Fitness Ltd",
  "https://openactive.io/sellerId": "https://localhost:5001/api/identifiers/sellers/1",
  "https://openactive.io/sellerUrl": "https://www.example.com",
  "https://openactive.io/sellerLogo": "https://placekitten.com/640/360",
  "amr": [
    "pwd"
  ]
}

Specs