---

name: userinfo-endpoint-reviewer description: Review test cases for UserInfo Endpoint. Covers access token validation, Bearer token handling, sub claim consistency, scope-based claims, and signed responses per OIDC Core 1.0 Section 5.3.

UserInfo Endpoint Test Case Reviewer

Review test cases for UserInfo Endpoint in OpenID Connect Basic OP.

Scope

• Feature: UserInfo Endpoint
• Specifications: OIDC Core 1.0 Section 5.3, 5.4
• Profile: Basic OP

Review Process

1. Identify which UserInfo requirement the test targets
2. Check against the checklist below
3. Verify both success and error scenarios
4. Ensure scope-based claim filtering is tested
5. Report gaps with specific spec section references

Basic Requirements

Request Format

GET Request

CopyGET /userinfo HTTP/1.1
Host: server.example.com
Authorization: Bearer SlAV32hkKG

POST Request

CopyPOST /userinfo HTTP/1.1
Host: server.example.com
Authorization: Bearer SlAV32hkKG
Content-Type: application/x-www-form-urlencoded

Response Format

JSON Response (Default)

CopyHTTP/1.1 200 OK
Content-Type: application/json

{
  "sub": "248289761001",
  "name": "Jane Doe",
  "given_name": "Jane",
  "family_name": "Doe",
  "email": "janedoe@example.com",
  "email_verified": true,
  "picture": "http://example.com/janedoe/me.jpg"
}

Signed Response (JWT)

Subject Identifier Consistency

Access Token Validation

Error Response

CopyHTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token",
  error_description="The access token expired"

Test Case Categories

Access Token Tests

• Valid: Bearer token in Authorization header
• Invalid: Missing Authorization header
• Invalid: Expired access token
• Invalid: Revoked access token
• Invalid: Malformed token

HTTP Method Tests

• Valid: GET request with Bearer token
• Valid: POST request with Bearer token
• Invalid: Other HTTP methods (PUT, DELETE, etc.)

Sub Claim Tests

• Valid: sub present in response
• Valid: sub matches ID Token sub
• Invalid: sub missing from response

Scope-Based Claims Tests

• Valid: Only requested scope claims returned
• Valid: openid scope returns sub only
• Valid: profile scope returns profile claims
• Valid: email scope returns email claims
• Valid: phone scope returns phone claims
• Valid: address scope returns address claim

Signed Response Tests (Optional)

• Valid: RS256 signed JWT response
• Valid: Signature verifiable with OP's key
• Valid: Honors registered userinfo_signed_response_alg

Scope to Claims Mapping

Error Responses

Conformance Test IDs

Review Output Format

Copy## Test Case: [Name]
### Target Feature: UserInfo Endpoint - [specific aspect]
### Test ID: OP-UserInfo-[xxx]
### Spec Compliance:
- [x] Covers required behavior per [spec section]
- [ ] Missing: [specific requirement]
### Sub Consistency:
- [x/blank] sub matches ID Token
### Verdict: PASS / FAIL / PARTIAL
### Recommendations: [if any]