---
id: ext-openid-conformance
title: "OpenID Conformance"
description: "Prepare an organisation for the OpenID Foundation conformance suite with the HAIP 1.0 test plans for OpenID4VCI 1.0 and OpenID4VP 1.0, run the tests and export the reports."
hide_title: false
sidebar_label: OpenID Conformance
keywords: [OpenID Conformance, OpenID Foundation, OIDF, conformance suite, HAIP, OpenID4VCI, OpenID4VP, certification, SD-JWT VC, mdoc, EUDI Wallet, Organisation Wallet, European Business Wallet]
slug: /extensions/openid-conformance
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import NoteBox from '@site/src/components/NoteBox';
import ApiEndpoints from '@site/src/components/ApiEndpoint';

The OpenID Conformance extension prepares an organisation for the [OpenID Foundation conformance suite](https://www.certification.openid.net) with one click. It covers the High Assurance Interoperability Profile (HAIP) 1.0 certification test plans for OpenID4VCI 1.0 and OpenID4VP 1.0, with the organisation as issuer, verifier or holder (wallet). The extension configures ordinary product settings and creates test fixtures. The system under test has no conformance-only behaviour.

<NoteBox title="For conformance tests only" variant="caution">
The certificates and keys that the extension creates are for conformance tests only. Never use them in production.
</NoteBox>

## How it works

1. The organisation enables the OpenID Conformance extension from the dashboard. The extension creates the test material described below.
2. An administrator selects a test plan and profile on the extension page. The page shows the plan name, the variant and a ready-to-use JSON configuration.
3. The administrator creates the test plan in the OIDF conformance suite with that plan name and variant, and pastes the configuration.
4. The administrator runs the test modules one at a time. When a module shows WAITING, the administrator does the action for the profile in the dashboard: log in, receive a credential or present a credential.
5. The administrator pastes an OIDF suite API token on the extension page, loads the test plans and exports the reports.

## What the extension creates

When enabled, the extension:

- creates x509 credential and status list signing keys with certificates of the organisation's built-in test CA, and the attester and key attestation JWKs that the suite configuration uses;
- registers three X509 CA trust authorities: the mdoc IACA and provider test roots of the organisation, and the mdoc IACA root of the conformance suite;
- creates system-managed credential definitions for the conformance PID (SD-JWT VC and mdoc), mDL (mdoc) and Photo ID (mdoc), bound to the built-in OpenID Conformance login provider, and issues one of each to the organisation's wallet unit (holder);
- creates system-managed presentation definitions for the PID (SD-JWT VC and mdoc, `direct_post.jwt`);
- sets the issuer settings that the test plans need: DPoP required, credential request encryption not required, batch issuance with batch size 3, signed issuer metadata with the conformance key, and issuer display extensions off;
- turns on credential encryption for the verifier and the holder.

The system-managed items are read-only in the dashboard. The Readiness section of the extension page shows whether each setting is in place.

## Certification profiles

Each profile on the extension page maps to a test plan and variant of the suite.

| Role of your deployment | Test plan | Profiles |
|---|---|---|
| Issuer | `oid4vci-1_0-issuer-haip-test-plan` | SD-JWT VC or mdoc; wallet-initiated or issuer-initiated |
| Verifier | `oid4vp-1final-verifier-haip-test-plan` | SD-JWT VC or mdoc; `direct_post.jwt` |
| Holder (wallet), issuance | `oid4vci-1_0-wallet-haip-test-plan` | SD-JWT VC or mdoc; wallet-initiated, or issuer-initiated with the offer by value or by reference |
| Holder (wallet), presentation | `oid4vp-1final-wallet-haip-test-plan` | SD-JWT VC or mdoc with the PID query of the extension, or the PID, mDL and Photo ID queries of the suite; `direct_post.jwt` |

The `dc_api` variants of the wallet presentation plan are not supported. Select a `direct_post.jwt` variant.

## Before you run

- Your deployment must be reachable from the internet. The URLs in the configuration come from your deployment domain.
- Do not change the issuer, verifier and holder settings that the extension sets.
- Holder tests need a Wallet Unit Attestation. Register a wallet unit before you run. The extension does not create one.
- If a conformance credential is missing from the wallet, or the extension was enabled before an update of the product, disable the extension and enable it again.

## While a test runs

A module does not complete on its own. When it shows WAITING, do the action for your profile. The extension page shows the full steps of the selected profile.

| Role | Action in the dashboard |
|---|---|
| Issuer | Open the link to your authorisation endpoint. It shows the OpenID Conformance login page. Click "Log in". For an issuer-initiated profile, first paste the `credential_offer_endpoint` of the module into the extension page and click "Send Credential Offer". |
| Verifier | Click "Request Credential(s)" on the conformance presentation definition and paste the `openid4vp://` link into the module. |
| Holder, issuance | Go to Wallet Unit (Holder) > Received Credentials > Receive Credential Offer. Request from the issuer URL of the test, or paste the `haip-vci://` offer that the suite shows. Accept the credential at once. |
| Holder, presentation | Go to Wallet Unit (Holder) > Shared Credentials > Respond to Verification Request. Paste the link and present the OpenID Conformance PID credential. |

Some modules end with the status REVIEW. Upload a screenshot of the result that your deployment showed. The OpenID Foundation checks these images when you submit the tests for certification.

## Test report

Paste the API token of your OIDF suite account on the extension page. The page lists your test plans with their modules, and you download the log of a module or of a whole plan as a ZIP file.

## Certification

When all modules pass, publish the test plan in the suite for certification. You get a signed ZIP file. Submit it at [submissions.openid.net](https://submissions.openid.net/) with a payment code and a signer, and sign the Certification of Conformance. The HAIP certification follows from the "/HAIP" plan variant.

## Integration

**API endpoints:**

<ApiEndpoints endpoints={[
  { method: 'get', path: '/v3/config/extension/openid-conformance', description: 'Read the extension: configuration material, readiness and the holder credentials' },
  { method: 'put', path: '/v3/config/extension/openid-conformance/report-token', description: 'Save the OIDF suite API token' },
  { method: 'get', path: '/v3/config/extension/openid-conformance/report/plans', description: 'List the test plans of the API token' },
  { method: 'get', path: '/v3/config/extension/openid-conformance/report/plan/{planId}', description: 'Read a test plan with its modules' },
  { method: 'get', path: '/v3/config/extension/openid-conformance/report/export/{testId}', description: 'Export the log of a test module as a ZIP file' },
  { method: 'post', path: '/v3/config/extension/openid-conformance/credential-offer', description: 'Send a credential offer to the suite (issuer-initiated profiles)' },
]} />

<NoteBox title="Caution:" variant="caution">
Disabling the OpenID Conformance extension deletes the conformance keys, trust authorities, credential definitions, presentation definitions and holder credentials, and restores the issuer and holder settings. This action is not reversible.
</NoteBox>