Merge pull request #276 from bshaffer/developv1.1

Create Tag v1.1

22 files changed, 899 insertions, 343 deletions

diff --git a/test/OAuth2/Encryption/JwtTest.php b/test/OAuth2/Encryption/JwtTest.php
new file mode 100644
index 0000000..b10c61b
--- /dev/null
+++ b/test/OAuth2/Encryption/JwtTest.php
@@ -0,0 +1,63 @@
+<?php
+
+namespace OAuth2\Encryption;
+
+use OAuth2\Storage\Bootstrap;
+
+class JwtTest extends \PHPUnit_Framework_TestCase
+{
+    private $privateKey;
+
+    public function setUp()
+    {
+        $this->privateKey = <<<EOD
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQC5/SxVlE8gnpFqCxgl2wjhzY7ucEi00s0kUg3xp7lVEvgLgYcA
+nHiWp+gtSjOFfH2zsvpiWm6Lz5f743j/FEzHIO1owR0p4d9pOaJK07d01+RzoQLO
+IQAgXrr4T1CCWUesncwwPBVCyy2Mw3Nmhmr9MrF8UlvdRKBxriRnlP3qJQIDAQAB
+AoGAVgJJVU4fhYMu1e5JfYAcTGfF+Gf+h3iQm4JCpoUcxMXf5VpB9ztk3K7LRN5y
+kwFuFALpnUAarRcUPs0D8FoP4qBluKksbAtgHkO7bMSH9emN+mH4le4qpFlR7+P1
+3fLE2Y19IBwPwEfClC+TpJvuog6xqUYGPlg6XLq/MxQUB4ECQQDgovP1v+ONSeGS
+R+NgJTR47noTkQT3M2izlce/OG7a+O0yw6BOZjNXqH2wx3DshqMcPUFrTjibIClP
+l/tEQ3ShAkEA0/TdBYDtXpNNjqg0R9GVH2pw7Kh68ne6mZTuj0kCgFYpUF6L6iMm
+zXamIJ51rTDsTyKTAZ1JuAhAsK/M2BbDBQJAKQ5fXEkIA+i+64dsDUR/hKLBeRYG
+PFAPENONQGvGBwt7/s02XV3cgGbxIgAxqWkqIp0neb9AJUoJgtyaNe3GQQJANoL4
+QQ0af0NVJAZgg8QEHTNL3aGrFSbzx8IE5Lb7PLRsJa5bP5lQxnDoYuU+EI/Phr62
+niisp/b/ZDGidkTMXQJBALeRsH1I+LmICAvWXpLKa9Gv0zGCwkuIJLiUbV9c6CVh
+suocCAteQwL5iW2gA4AnYr5OGeHFsEl7NCQcwfPZpJ0=
+-----END RSA PRIVATE KEY-----
+EOD;
+    }
+
+    /** @dataProvider provideClientCredentials */
+    public function testJwtUtil($client_id, $client_key)
+    {
+        $jwtUtil = new Jwt();
+
+        $params = array(
+            'iss' => $client_id,
+            'exp' => time() + 1000,
+            'iat' => time(),
+            'sub' => 'testuser@ourdomain.com',
+            'aud' => 'http://myapp.com/oauth/auth',
+            'scope' => null,
+        );
+
+        $encoded = $jwtUtil->encode($params, $this->privateKey, 'RS256');
+
+        $payload = $jwtUtil->decode($encoded, $client_key);
+
+        $this->assertEquals($params, $payload);
+    }
+
+    public function provideClientCredentials()
+    {
+        $storage = Bootstrap::getInstance()->getMemoryStorage();
+        $client_id  = 'Test Client ID';
+        $client_key = $storage->getClientKey($client_id, "testuser@ourdomain.com");
+
+        return array(
+            array($client_id, $client_key),
+        );
+    }
+}
diff --git a/test/OAuth2/GrantType/ClientCredentialsTest.php b/test/OAuth2/GrantType/ClientCredentialsTest.php
index 8077e61..f0d46cc 100644
--- a/test/OAuth2/GrantType/ClientCredentialsTest.php
+++ b/test/OAuth2/GrantType/ClientCredentialsTest.php
@@ -127,6 +127,27 @@ class ClientCredentialsTest extends \PHPUnit_Framework_TestCase
         $this->assertNotNull($token['access_token']);
     }
 
+    public function testClientUserIdIsSetInAccessToken()
+    {
+        $server = $this->getTestServer();
+        $request = TestRequest::createPost(array(
+            'grant_type'    => 'client_credentials', // valid grant type
+            'client_id'     => 'Client ID With User ID', // valid client id
+            'client_secret' => 'TestSecret', // valid client secret
+        ));
+        $token = $server->grantAccessToken($request, new Response());
+
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+
+        // verify the user_id was associated with the token
+        $storage = $server->getStorage('client');
+        $token = $storage->getAccessToken($token['access_token']);
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('user_id', $token);
+        $this->assertEquals($token['user_id'], 'brent@brentertainment.com');
+    }
+
     private function getTestServer()
     {
         $storage = Bootstrap::getInstance()->getMemoryStorage();
diff --git a/test/OAuth2/GrantType/JWTBearerTest.php b/test/OAuth2/GrantType/JWTBearerTest.php
index 50fa77e..4b36ef2 100644
--- a/test/OAuth2/GrantType/JWTBearerTest.php
+++ b/test/OAuth2/GrantType/JWTBearerTest.php
@@ -261,24 +261,51 @@ EOD;
         $this->assertEquals($response->getParameter('error_description'), 'An unsupported scope was requested');
     }
 
-    public function testJwtUtil()
+    public function testValidJti()
     {
-        $storage = Bootstrap::getInstance()->getMemoryStorage();
-        $jwtUtil = new Jwt();
-        $client_id = 'Test Client ID';
-        $params = $this->getJWTParams(null, null, null, $client_id);
+        $server = $this->getTestServer();
+        $request = TestRequest::createPost(array(
+                'grant_type' => 'urn:ietf:params:oauth:grant-type:jwt-bearer',  // valid grant type
+                'assertion' => $this->getJWT(null, null, 'testuser@ourdomain.com', 'Test Client ID', null, 'unused_jti'), // valid assertion with invalid scope
+        ));
+        $token = $server->grantAccessToken($request, $response = new Response());
 
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+    }
 
-        if (version_compare(PHP_VERSION, '5.3.3') <= 0) {
-            $encoded = $jwtUtil->encode($params, 'mysecretkey', 'HS256');
-            $client_id .= ' PHP-5.2';
-        } else {
-            $encoded = $jwtUtil->encode($params, $this->privateKey, 'RS256');
-        }
+    public function testInvalidJti()
+    {
+        $server = $this->getTestServer();
+        $request = TestRequest::createPost(array(
+                'grant_type' => 'urn:ietf:params:oauth:grant-type:jwt-bearer',  // valid grant type
+                'assertion' => $this->getJWT(99999999900, null, 'testuser@ourdomain.com', 'Test Client ID', null, 'used_jti'), // valid assertion with invalid scope
+        ));
+        $token = $server->grantAccessToken($request, $response = new Response());
 
-        $payload = $jwtUtil->decode($encoded, $storage->getClientKey($client_id, "testuser@ourdomain.com"));
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_grant');
+        $this->assertEquals($response->getParameter('error_description'), 'JSON Token Identifier (jti) has already been used');
+    }
 
-        $this->assertEquals($params, $payload);
+    public function testJtiReplayAttack()
+    {
+        $server = $this->getTestServer();
+        $request = TestRequest::createPost(array(
+                'grant_type' => 'urn:ietf:params:oauth:grant-type:jwt-bearer',  // valid grant type
+                'assertion' => $this->getJWT(99999999900, null, 'testuser@ourdomain.com', 'Test Client ID', null, 'totally_new_jti'), // valid assertion with invalid scope
+        ));
+        $token = $server->grantAccessToken($request, $response = new Response());
+
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+
+        //Replay the same request
+        $token = $server->grantAccessToken($request, $response = new Response());
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'invalid_grant');
+        $this->assertEquals($response->getParameter('error_description'), 'JSON Token Identifier (jti) has already been used');
     }
 
     /**
@@ -289,15 +316,8 @@ EOD;
      * @param $iss The issuer, usually the client_id.
      * @return string
      */
-    private function getJWTParams($exp = null, $nbf = null, $sub = null, $iss = 'Test Client ID', $scope = null)
+    private function getJWT($exp = null, $nbf = null, $sub = null, $iss = 'Test Client ID', $scope = null, $jti = null)
     {
-        //Since PHP 5.2 does not have OpenSSL support on Travis CI, we will test it using the HS256 algorithm
-        //We also provided PHP 5.2 specific data for it in storage.json
-        if (version_compare(PHP_VERSION, '5.3.3') <= 0) {
-            // add "5.2" identifier onto the client name
-            $iss .= ' PHP-5.2';
-        }
-
         if (!$exp) {
             $exp = time() + 1000;
         }
@@ -319,19 +339,12 @@ EOD;
             $params['nbf'] = $nbf;
         }
 
-        return $params;
-    }
-
-    private function getJWT($exp = null, $nbf = null, $sub = null, $iss = 'Test Client ID', $scope = null)
-    {
-        $params = $this->getJWTParams($exp, $nbf, $sub, $iss, $scope);
+        if ($jti) {
+            $params['jti'] = $jti;
+        }
 
         $jwtUtil = new Jwt();
 
-        if (version_compare(PHP_VERSION, '5.3.3') <= 0) {
-            return $jwtUtil->encode($params, 'mysecretkey', 'HS256');
-        }
-
         return $jwtUtil->encode($params, $this->privateKey, 'RS256');
     }
 
diff --git a/test/OAuth2/ResponseType/CryptoTokenTest.php b/test/OAuth2/ResponseType/CryptoTokenTest.php
new file mode 100644
index 0000000..32f81a1
--- /dev/null
+++ b/test/OAuth2/ResponseType/CryptoTokenTest.php
@@ -0,0 +1,88 @@
+<?php
+
+namespace OAuth2\ResponseType;
+
+use OAuth2\Server;
+use OAuth2\Response;
+use OAuth2\Request\TestRequest;
+use OAuth2\Storage\Bootstrap;
+use OAuth2\Storage\CryptoToken as CryptoTokenStorage;
+use OAuth2\GrantType\ClientCredentials;
+
+class CryptoTokenTest extends \PHPUnit_Framework_TestCase
+{
+    public function testGrantCryptoToken()
+    {
+        // add the test parameters in memory
+        $server = $this->getTestServer();
+        $request = TestRequest::createPost(array(
+            'grant_type'    => 'client_credentials', // valid grant type
+            'client_id'     => 'Test Client ID',     // valid client id
+            'client_secret' => 'TestSecret',         // valid client secret
+        ));
+        $server->handleTokenRequest($request, $response = new Response());
+
+        $this->assertNotNull($response->getParameter('access_token'));
+        $this->assertEquals(2, substr_count($response->getParameter('access_token'), '.'));
+    }
+
+    public function testAccessResourceWithCryptoToken()
+    {
+        // add the test parameters in memory
+        $server = $this->getTestServer();
+        $request = TestRequest::createPost(array(
+            'grant_type'    => 'client_credentials', // valid grant type
+            'client_id'     => 'Test Client ID',     // valid client id
+            'client_secret' => 'TestSecret',         // valid client secret
+        ));
+        $server->handleTokenRequest($request, $response = new Response());
+        $this->assertNotNull($cryptoToken = $response->getParameter('access_token'));
+
+        // make a call to the resource server using the crypto token
+        $request = TestRequest::createPost(array(
+            'access_token' => $cryptoToken,
+        ));
+
+        $this->assertTrue($server->verifyResourceRequest($request));
+    }
+
+    public function testAccessResourceWithCryptoTokenUsingSecondaryStorage()
+    {
+        // add the test parameters in memory
+        $server = $this->getTestServer();
+        $request = TestRequest::createPost(array(
+            'grant_type'    => 'client_credentials', // valid grant type
+            'client_id'     => 'Test Client ID',     // valid client id
+            'client_secret' => 'TestSecret',         // valid client secret
+        ));
+        $server->handleTokenRequest($request, $response = new Response());
+        $this->assertNotNull($cryptoToken = $response->getParameter('access_token'));
+
+        // make a call to the resource server using the crypto token
+        $request = TestRequest::createPost(array(
+            'access_token' => $cryptoToken,
+        ));
+
+        // create a resource server with the "memory" storage from the grant server
+        $resourceServer = new Server($server->getStorage('client_credentials'));
+
+        $this->assertTrue($resourceServer->verifyResourceRequest($request));
+    }
+
+    private function getTestServer()
+    {
+        $memoryStorage = Bootstrap::getInstance()->getMemoryStorage();
+
+        $storage = array(
+            'access_token' => new CryptoTokenStorage($memoryStorage),
+            'client_credentials' => $memoryStorage,
+        );
+        $server = new Server($storage);
+        $server->addGrantType(new ClientCredentials($memoryStorage));
+
+        // make the "token" response type a CryptoToken
+        $server->addResponseType(new CryptoToken($memoryStorage, $memoryStorage));
+
+        return $server;
+    }
+}
diff --git a/test/OAuth2/ServerTest.php b/test/OAuth2/ServerTest.php
index 5960235..b61f851 100644
--- a/test/OAuth2/ServerTest.php
+++ b/test/OAuth2/ServerTest.php
@@ -265,6 +265,35 @@ class ServerTest extends \PHPUnit_Framework_TestCase
         $this->assertEquals($config['allow_credentials_in_request_body'], false);
     }
 
+    public function testRefreshTokenConfig()
+    {
+        // create mock storage
+        $storage = Bootstrap::getInstance()->getMemoryStorage();
+        $server1 = new Server(array($storage));
+        $server2 = new Server(array($storage), array('always_issue_new_refresh_token' => true));
+
+        $server1->getTokenController();
+        $refreshToken1 = $server1->getGrantType('refresh_token');
+
+        $server2->getTokenController();
+        $refreshToken2 = $server2->getGrantType('refresh_token');
+
+        $reflection1 = new \ReflectionClass($refreshToken1);
+        $prop1 = $reflection1->getProperty('config');
+        $prop1->setAccessible(true);
+
+        $reflection2 = new \ReflectionClass($refreshToken2);
+        $prop2 = $reflection2->getProperty('config');
+        $prop2->setAccessible(true);
+
+        // get the private "config" property
+        $config1 = $prop1->getValue($refreshToken1);
+        $config2 = $prop2->getValue($refreshToken2);
+
+        $this->assertEquals($config1['always_issue_new_refresh_token'], false);
+        $this->assertEquals($config2['always_issue_new_refresh_token'], true);
+    }
+
     /**
      * @expectedException InvalidArgumentException OAuth2\ResponseType\AuthorizationCodeInterface
      **/
diff --git a/test/OAuth2/Storage/AccessTokenTest.php b/test/OAuth2/Storage/AccessTokenTest.php
new file mode 100644
index 0000000..17c9cd9
--- /dev/null
+++ b/test/OAuth2/Storage/AccessTokenTest.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace OAuth2\Storage;
+
+class AccessTokenTest extends BaseTest
+{
+    /** @dataProvider provideStorage */
+    public function testSetAccessToken(AccessTokenInterface $storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+        // assert token we are about to add does not exist
+        $token = $storage->getAccessToken('newtoken');
+        $this->assertFalse($token);
+
+        // add new token
+        $expires = time() + 20;
+        $success = $storage->setAccessToken('newtoken', 'client ID', 'SOMEUSERID', $expires);
+        $this->assertTrue($success);
+
+        $token = $storage->getAccessToken('newtoken');
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+        $this->assertArrayHasKey('client_id', $token);
+        $this->assertArrayHasKey('user_id', $token);
+        $this->assertArrayHasKey('expires', $token);
+        $this->assertEquals($token['access_token'], 'newtoken');
+        $this->assertEquals($token['client_id'], 'client ID');
+        $this->assertEquals($token['user_id'], 'SOMEUSERID');
+        $this->assertEquals($token['expires'], $expires);
+
+        // change existing token
+        $expires = time() + 42;
+        $success = $storage->setAccessToken('newtoken', 'client ID2', 'SOMEOTHERID', $expires);
+        $this->assertTrue($success);
+
+        $token = $storage->getAccessToken('newtoken');
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('access_token', $token);
+        $this->assertArrayHasKey('client_id', $token);
+        $this->assertArrayHasKey('user_id', $token);
+        $this->assertArrayHasKey('expires', $token);
+        $this->assertEquals($token['access_token'], 'newtoken');
+        $this->assertEquals($token['client_id'], 'client ID2');
+        $this->assertEquals($token['user_id'], 'SOMEOTHERID');
+        $this->assertEquals($token['expires'], $expires);
+    }
+}
diff --git a/test/OAuth2/Storage/AuthorizationCodeTest.php b/test/OAuth2/Storage/AuthorizationCodeTest.php
new file mode 100644
index 0000000..9f57714
--- /dev/null
+++ b/test/OAuth2/Storage/AuthorizationCodeTest.php
@@ -0,0 +1,72 @@
+<?php
+
+namespace OAuth2\Storage;
+
+class AuthorizationCodeTest extends BaseTest
+{
+    /** @dataProvider provideStorage */
+    public function testGetAuthorizationCode(AuthorizationCodeInterface $storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+        // nonexistant client_id
+        $details = $storage->getAuthorizationCode('faketoken');
+        $this->assertFalse($details);
+
+        // valid client_id
+        $details = $storage->getAuthorizationCode('testtoken');
+        $this->assertNotNull($details);
+    }
+
+    /** @dataProvider provideStorage */
+    public function testSetAuthorizationCode(AuthorizationCodeInterface $storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+        // assert code we are about to add does not exist
+        $code = $storage->getAuthorizationCode('newcode');
+        $this->assertFalse($code);
+
+        // add new code
+        $expires = time() + 20;
+        $success = $storage->setAuthorizationCode('newcode', 'client ID', 'SOMEUSERID', 'http://example.com', $expires);
+        $this->assertTrue($success);
+
+        $code = $storage->getAuthorizationCode('newcode');
+        $this->assertNotNull($code);
+        $this->assertArrayHasKey('authorization_code', $code);
+        $this->assertArrayHasKey('client_id', $code);
+        $this->assertArrayHasKey('user_id', $code);
+        $this->assertArrayHasKey('redirect_uri', $code);
+        $this->assertArrayHasKey('expires', $code);
+        $this->assertEquals($code['authorization_code'], 'newcode');
+        $this->assertEquals($code['client_id'], 'client ID');
+        $this->assertEquals($code['user_id'], 'SOMEUSERID');
+        $this->assertEquals($code['redirect_uri'], 'http://example.com');
+        $this->assertEquals($code['expires'], $expires);
+
+        // change existing code
+        $expires = time() + 42;
+        $success = $storage->setAuthorizationCode('newcode', 'client ID2', 'SOMEOTHERID', 'http://example.org', $expires);
+        $this->assertTrue($success);
+
+        $code = $storage->getAuthorizationCode('newcode');
+        $this->assertNotNull($code);
+        $this->assertArrayHasKey('authorization_code', $code);
+        $this->assertArrayHasKey('client_id', $code);
+        $this->assertArrayHasKey('user_id', $code);
+        $this->assertArrayHasKey('redirect_uri', $code);
+        $this->assertArrayHasKey('expires', $code);
+        $this->assertEquals($code['authorization_code'], 'newcode');
+        $this->assertEquals($code['client_id'], 'client ID2');
+        $this->assertEquals($code['user_id'], 'SOMEOTHERID');
+        $this->assertEquals($code['redirect_uri'], 'http://example.org');
+        $this->assertEquals($code['expires'], $expires);
+    }
+}
diff --git a/test/OAuth2/Storage/ClientCredentialsTest.php b/test/OAuth2/Storage/ClientCredentialsTest.php
new file mode 100644
index 0000000..ecaf6f6
--- /dev/null
+++ b/test/OAuth2/Storage/ClientCredentialsTest.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace OAuth2\Storage;
+
+class ClientCredentialsTest extends BaseTest
+{
+    /** @dataProvider provideStorage */
+    public function testCheckClientCredentials(ClientCredentialsInterface $storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+        // nonexistant client_id
+        $pass = $storage->checkClientCredentials('fakeclient', 'testpass');
+        $this->assertFalse($pass);
+
+        // invalid password
+        $pass = $storage->checkClientCredentials('oauth_test_client', 'invalidcredentials');
+        $this->assertFalse($pass);
+
+        // valid credentials
+        $pass = $storage->checkClientCredentials('oauth_test_client', 'testpass');
+        $this->assertTrue($pass);
+    }
+}
diff --git a/test/OAuth2/Storage/ClientTest.php b/test/OAuth2/Storage/ClientTest.php
new file mode 100644
index 0000000..4d95c6c
--- /dev/null
+++ b/test/OAuth2/Storage/ClientTest.php
@@ -0,0 +1,84 @@
+<?php
+
+namespace OAuth2\Storage;
+
+class ClientTest extends BaseTest
+{
+    /** @dataProvider provideStorage */
+    public function testGetClientDetails(ClientInterface $storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+        // nonexistant client_id
+        $details = $storage->getClientDetails('fakeclient');
+        $this->assertFalse($details);
+
+        // valid client_id
+        $details = $storage->getClientDetails('oauth_test_client');
+        $this->assertNotNull($details);
+        $this->assertArrayHasKey('client_id', $details);
+        $this->assertArrayHasKey('client_secret', $details);
+        $this->assertArrayHasKey('redirect_uri', $details);
+    }
+
+    /** @dataProvider provideStorage */
+    public function testCheckRestrictedGrantType(ClientInterface $storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+
+        // Check invalid
+        $pass = $storage->checkRestrictedGrantType('oauth_test_client', 'authorization_code');
+        $this->assertFalse($pass);
+
+        // Check valid
+        $pass = $storage->checkRestrictedGrantType('oauth_test_client', 'implicit');
+        $this->assertTrue($pass);
+    }
+
+    /** @dataProvider provideStorage */
+    public function testGetAccessToken(ClientInterface $storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+        // nonexistant client_id
+        $details = $storage->getAccessToken('faketoken');
+        $this->assertFalse($details);
+
+        // valid client_id
+        $details = $storage->getAccessToken('testtoken');
+        $this->assertNotNull($details);
+    }
+
+    /** @dataProvider provideStorage */
+    public function testSaveClient(ClientInterface $storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+
+        $clientId = 'some-client-'.rand();
+
+        // create a new client
+        $success = $storage->setClientDetails($clientId, 'somesecret', 'http://test.com', 'client_credentials', 'brent@brentertainment.com');
+        $this->assertTrue($success);
+
+        // valid client_id
+        $details = $storage->getClientDetails($clientId);
+        $this->assertEquals($details['client_secret'], 'somesecret');
+        $this->assertEquals($details['redirect_uri'], 'http://test.com');
+        $this->assertEquals($details['grant_types'], 'client_credentials');
+        $this->assertEquals($details['user_id'], 'brent@brentertainment.com');
+    }
+}
diff --git a/test/OAuth2/Storage/CryptoTokenTest.php b/test/OAuth2/Storage/CryptoTokenTest.php
new file mode 100644
index 0000000..4a63b7e
--- /dev/null
+++ b/test/OAuth2/Storage/CryptoTokenTest.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace OAuth2\Storage;
+
+use OAuth2\Encryption\Jwt;
+
+class CryptoTokenTest extends BaseTest
+{
+    /** @dataProvider provideStorage */
+    public function testSetAccessToken($storage)
+    {
+        $publicKeyStorage = Bootstrap::getInstance()->getMemoryStorage();
+        $encryptionUtil = new Jwt();
+
+        $cryptoToken = array(
+            'access_token' => rand(),
+            'expires' => time() + 100,
+            'scope'   => 'foo',
+        );
+
+        $token = $encryptionUtil->encode($cryptoToken, $publicKeyStorage->getPrivateKey(), $publicKeyStorage->getEncryptionAlgorithm());
+
+        $this->assertNotNull($token);
+
+        $tokenData = $storage->getAccessToken($token);
+
+        $this->assertTrue(is_array($tokenData));
+
+        /* assert the decoded token is the same */
+        $this->assertEquals($tokenData['access_token'], $cryptoToken['access_token']);
+        $this->assertEquals($tokenData['expires'], $cryptoToken['expires']);
+        $this->assertEquals($tokenData['scope'], $cryptoToken['scope']);
+    }
+
+    // @TODO - use the BaseTest provideStorage, and add support for storages which omit certain interfaces
+    public function provideStorage()
+    {
+        $memory = Bootstrap::getInstance()->getMemoryStorage();
+        $storage = new CryptoToken($memory);
+
+        return array(
+            array($storage)
+        );
+    }
+}
diff --git a/test/OAuth2/Storage/PublicKeyTest.php b/test/OAuth2/Storage/PublicKeyTest.php
new file mode 100644
index 0000000..d08c9c0
--- /dev/null
+++ b/test/OAuth2/Storage/PublicKeyTest.php
@@ -0,0 +1,22 @@
+<?php
+
+namespace OAuth2\Storage;
+
+class PublicKeyTest extends BaseTest
+{
+    /** @dataProvider provideStorage */
+    public function testSetAccessToken($storage)
+    {
+        if (is_null($storage) || !$storage instanceof PublicKeyInterface) {
+            return $this->markTestSkipped('Invalid storage for public key test');
+        }
+
+        $configDir = Bootstrap::getInstance()->getConfigDir();
+        $globalPublicKey  = file_get_contents($configDir.'/keys/id_rsa.pub');
+        $globalPrivateKey = file_get_contents($configDir.'/keys/id_rsa');
+
+        /* assert values from storage */
+        $this->assertEquals($storage->getPublicKey(), $globalPublicKey);
+        $this->assertEquals($storage->getPrivateKey(), $globalPrivateKey);
+    }
+}
diff --git a/test/OAuth2/Storage/RefreshTokenTest.php b/test/OAuth2/Storage/RefreshTokenTest.php
new file mode 100644
index 0000000..7777bb9
--- /dev/null
+++ b/test/OAuth2/Storage/RefreshTokenTest.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace OAuth2\Storage;
+
+class RefreshTokenTest extends BaseTest
+{
+    /** @dataProvider provideStorage */
+    public function testSetRefreshToken(RefreshTokenInterface $storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+        // assert token we are about to add does not exist
+        $token = $storage->getRefreshToken('refreshtoken');
+        $this->assertFalse($token);
+
+        // add new token
+        $expires = time() + 20;
+        $success = $storage->setRefreshToken('refreshtoken', 'client ID', 'SOMEUSERID', $expires);
+        $this->assertTrue($success);
+
+        $token = $storage->getRefreshToken('refreshtoken');
+        $this->assertNotNull($token);
+        $this->assertArrayHasKey('refresh_token', $token);
+        $this->assertArrayHasKey('client_id', $token);
+        $this->assertArrayHasKey('user_id', $token);
+        $this->assertArrayHasKey('expires', $token);
+        $this->assertEquals($token['refresh_token'], 'refreshtoken');
+        $this->assertEquals($token['client_id'], 'client ID');
+        $this->assertEquals($token['user_id'], 'SOMEUSERID');
+        $this->assertEquals($token['expires'], $expires);
+    }
+}
diff --git a/test/OAuth2/Storage/ScopeTest.php b/test/OAuth2/Storage/ScopeTest.php
new file mode 100644
index 0000000..a34ce54
--- /dev/null
+++ b/test/OAuth2/Storage/ScopeTest.php
@@ -0,0 +1,94 @@
+<?php
+
+namespace OAuth2\Storage;
+
+use OAuth2\Scope;
+
+class ScopeTest extends BaseTest
+{
+    /** @dataProvider provideStorage */
+    public function testScopeExists($storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+
+        if (!$storage instanceof ScopeInterface) {
+            $this->markTestSkipped('Skipping incompatible storage');
+
+            return;
+        }
+
+        //Test getting scopes with a client_id
+        $scopeUtil = new Scope($storage);
+        $this->assertTrue($scopeUtil->scopeExists('clientscope1 clientscope2', 'Test Client ID'));
+        $this->assertFalse($scopeUtil->scopeExists('clientscope1 clientscope2 clientscope3', 'Test Client ID'));
+        $this->assertTrue($scopeUtil->scopeExists('clientscope3', 'Test Client ID 2'));
+    }
+
+    /** @dataProvider provideStorage */
+    public function testGetDefaultScope($storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+
+        if (!$storage instanceof ScopeInterface) {
+            $this->markTestSkipped('Skipping incompatible storage');
+
+            return;
+        }
+
+        // test getting default scope
+        $scopeUtil = new Scope($storage);
+        $this->assertEquals($scopeUtil->getDefaultScope(), 'defaultscope1 defaultscope2');
+    }
+
+    /** @dataProvider provideStorage */
+    public function testClientScopeExists($storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+
+        if (!$storage instanceof ScopeInterface) {
+            $this->markTestSkipped('Skipping incompatible storage');
+
+            return;
+        }
+
+        // test getting scopes with a client_id
+        $scopeUtil = new Scope($storage);
+        $this->assertTrue($scopeUtil->scopeExists('supportedscope1'));
+        $this->assertTrue($scopeUtil->scopeExists('supportedscope2'));
+        $this->assertTrue($scopeUtil->scopeExists('supportedscope1 supportedscope2'));
+        $this->assertFalse($scopeUtil->scopeExists('bogusscope'));
+    }
+
+    /** @dataProvider provideStorage */
+    public function testGetDefaultClientScope($storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+
+        if (!$storage instanceof ScopeInterface) {
+            $this->markTestSkipped('Skipping incompatible storage');
+
+            return;
+        }
+
+        // test getting scopes with a client_id
+        $scopeUtil = new Scope($storage);
+        $this->assertEquals($scopeUtil->getDefaultScope('Test Default Scope Client ID'), 'clientscope1 clientscope2');
+        $this->assertEquals($scopeUtil->getDefaultScope('Test Default Scope Client ID 2'), 'clientscope3');
+    }
+}
diff --git a/test/OAuth2/Storage/UserCredentialsTest.php b/test/OAuth2/Storage/UserCredentialsTest.php
new file mode 100644
index 0000000..ee1c721
--- /dev/null
+++ b/test/OAuth2/Storage/UserCredentialsTest.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace OAuth2\Storage;
+
+class UserCredentialsTest extends BaseTest
+{
+    /** @dataProvider provideStorage */
+    public function testCheckUserCredentials(UserCredentialsInterface $storage = null)
+    {
+        if (is_null($storage)) {
+            $this->markTestSkipped('Unable to load class Mongo_Client');
+
+            return;
+        }
+        // create a new user for testing
+        $success = $storage->setUser('testusername', 'testpass', 'Test', 'User');
+        $this->assertTrue($success);
+
+        // correct credentials
+        $this->assertTrue($storage->checkUserCredentials('testusername', 'testpass'));
+        // invalid password
+        $this->assertFalse($storage->checkUserCredentials('testusername', 'fakepass'));
+        // invalid username
+        $this->assertFalse($storage->checkUserCredentials('fakeusername', 'testpass'));
+
+        // invalid username
+        $this->assertFalse($storage->getUserDetails('fakeusername'));
+
+        // ensure all properties are set
+        $user = $storage->getUserDetails('testusername');
+        $this->assertTrue($user !== false);
+        $this->assertArrayHasKey('user_id', $user);
+        $this->assertArrayHasKey('first_name', $user);
+        $this->assertArrayHasKey('last_name', $user);
+        $this->assertEquals($user['user_id'], 'testusername');
+        $this->assertEquals($user['first_name'], 'Test');
+        $this->assertEquals($user['last_name'], 'User');
+    }
+}
diff --git a/test/OAuth2/StorageTest.php b/test/OAuth2/StorageTest.php
deleted file mode 100644
index 9a36cb8..0000000
--- a/test/OAuth2/StorageTest.php
+++ /dev/null
@@ -1,271 +0,0 @@
-<?php
-
-namespace OAuth2;
-
-use OAuth2\Storage\ClientCredentialsInterface;
-use OAuth2\Storage\ClientInterface;
-use OAuth2\Storage\AccessTokenInterface;
-use OAuth2\Storage\RefreshTokenInterface;
-use OAuth2\Storage\AuthorizationCodeInterface;
-use OAuth2\Storage\Bootstrap;
-
-class StorageTest extends \PHPUnit_Framework_TestCase
-{
-    /** @dataProvider provideStorage */
-    public function testCheckClientCredentials(ClientCredentialsInterface $storage = null)
-    {
-        if (is_null($storage)) {
-            $this->markTestSkipped('Unable to load class Mongo_Client');
-            return;
-        }
-        // nonexistant client_id
-        $pass = $storage->checkClientCredentials('fakeclient', 'testpass');
-        $this->assertFalse($pass);
-
-        // invalid password
-        $pass = $storage->checkClientCredentials('oauth_test_client', 'invalidcredentials');
-        $this->assertFalse($pass);
-
-        // valid credentials
-        $pass = $storage->checkClientCredentials('oauth_test_client', 'testpass');
-        $this->assertTrue($pass);
-    }
-
-    /** @dataProvider provideStorage */
-    public function testGetClientDetails(ClientInterface $storage = null)
-    {
-        if (is_null($storage)) {
-            $this->markTestSkipped('Unable to load class Mongo_Client');
-            return;
-        }
-        // nonexistant client_id
-        $details = $storage->getClientDetails('fakeclient');
-        $this->assertFalse($details);
-
-        // valid client_id
-        $details = $storage->getClientDetails('oauth_test_client');
-        $this->assertNotNull($details);
-        $this->assertArrayHasKey('client_id', $details);
-        $this->assertArrayHasKey('client_secret', $details);
-        $this->assertArrayHasKey('redirect_uri', $details);
-    }
-
-    /** @dataProvider provideStorage */
-    public function testCheckRestrictedGrantType(ClientInterface $storage = null)
-    {
-        if (is_null($storage)) {
-            $this->markTestSkipped('Unable to load class Mongo_Client');
-            return;
-        }
-
-        // Check invalid
-        $pass = $storage->checkRestrictedGrantType('oauth_test_client', 'authorization_code');
-        $this->assertFalse($pass);
-
-        // Check valid
-        $pass = $storage->checkRestrictedGrantType('oauth_test_client', 'implicit');
-        $this->assertTrue($pass);
-    }
-
-    /** @dataProvider provideStorage */
-    public function testGetAccessToken(ClientInterface $storage = null)
-    {
-        if (is_null($storage)) {
-            $this->markTestSkipped('Unable to load class Mongo_Client');
-            return;
-        }
-        // nonexistant client_id
-        $details = $storage->getAccessToken('faketoken');
-        $this->assertFalse($details);
-
-        // valid client_id
-        $details = $storage->getAccessToken('testtoken');
-        $this->assertNotNull($details);
-    }
-
-    /** @dataProvider provideStorage */
-    public function testSetAccessToken(AccessTokenInterface $storage = null)
-    {
-        if (is_null($storage)) {
-            $this->markTestSkipped('Unable to load class Mongo_Client');
-            return;
-        }
-        // assert token we are about to add does not exist
-        $token = $storage->getAccessToken('newtoken');
-        $this->assertFalse($token);
-
-        // add new token
-        $expires = time() + 20;
-        $success = $storage->setAccessToken('newtoken', 'client ID', 'SOMEUSERID', $expires);
-        $this->assertTrue($success);
-
-        $token = $storage->getAccessToken('newtoken');
-        $this->assertNotNull($token);
-        $this->assertArrayHasKey('access_token', $token);
-        $this->assertArrayHasKey('client_id', $token);
-        $this->assertArrayHasKey('user_id', $token);
-        $this->assertArrayHasKey('expires', $token);
-        $this->assertEquals($token['access_token'], 'newtoken');
-        $this->assertEquals($token['client_id'], 'client ID');
-        $this->assertEquals($token['user_id'], 'SOMEUSERID');
-        $this->assertEquals($token['expires'], $expires);
-
-        // change existing token
-        $expires = time() + 42;
-        $success = $storage->setAccessToken('newtoken', 'client ID2', 'SOMEOTHERID', $expires);
-        $this->assertTrue($success);
-
-        $token = $storage->getAccessToken('newtoken');
-        $this->assertNotNull($token);
-        $this->assertArrayHasKey('access_token', $token);
-        $this->assertArrayHasKey('client_id', $token);
-        $this->assertArrayHasKey('user_id', $token);
-        $this->assertArrayHasKey('expires', $token);
-        $this->assertEquals($token['access_token'], 'newtoken');
-        $this->assertEquals($token['client_id'], 'client ID2');
-        $this->assertEquals($token['user_id'], 'SOMEOTHERID');
-        $this->assertEquals($token['expires'], $expires);
-    }
-
-    /** @dataProvider provideStorage */
-    public function testSetRefreshToken(RefreshTokenInterface $storage = null)
-    {
-        if (is_null($storage)) {
-            $this->markTestSkipped('Unable to load class Mongo_Client');
-            return;
-        }
-        // assert token we are about to add does not exist
-        $token = $storage->getRefreshToken('refreshtoken');
-        $this->assertFalse($token);
-
-        // add new token
-        $expires = time() + 20;
-        $success = $storage->setRefreshToken('refreshtoken', 'client ID', 'SOMEUSERID', $expires);
-        $this->assertTrue($success);
-
-        $token = $storage->getRefreshToken('refreshtoken');
-        $this->assertNotNull($token);
-        $this->assertArrayHasKey('refresh_token', $token);
-        $this->assertArrayHasKey('client_id', $token);
-        $this->assertArrayHasKey('user_id', $token);
-        $this->assertArrayHasKey('expires', $token);
-        $this->assertEquals($token['refresh_token'], 'refreshtoken');
-        $this->assertEquals($token['client_id'], 'client ID');
-        $this->assertEquals($token['user_id'], 'SOMEUSERID');
-        $this->assertEquals($token['expires'], $expires);
-    }
-
-    /** @dataProvider provideStorage */
-    public function testGetAuthorizationCode(AuthorizationCodeInterface $storage = null)
-    {
-        if (is_null($storage)) {
-            $this->markTestSkipped('Unable to load class Mongo_Client');
-            return;
-        }
-        // nonexistant client_id
-        $details = $storage->getAuthorizationCode('faketoken');
-        $this->assertFalse($details);
-
-        // valid client_id
-        $details = $storage->getAuthorizationCode('testtoken');
-        $this->assertNotNull($details);
-    }
-
-    /** @dataProvider provideStorage */
-    public function testSetAuthorizationCode(AuthorizationCodeInterface $storage = null)
-    {
-        if (is_null($storage)) {
-            $this->markTestSkipped('Unable to load class Mongo_Client');
-            return;
-        }
-        // assert code we are about to add does not exist
-        $code = $storage->getAuthorizationCode('newcode');
-        $this->assertFalse($code);
-
-        // add new code
-        $expires = time() + 20;
-        $success = $storage->setAuthorizationCode('newcode', 'client ID', 'SOMEUSERID', 'http://example.com', $expires);
-        $this->assertTrue($success);
-
-        $code = $storage->getAuthorizationCode('newcode');
-        $this->assertNotNull($code);
-        $this->assertArrayHasKey('authorization_code', $code);
-        $this->assertArrayHasKey('client_id', $code);
-        $this->assertArrayHasKey('user_id', $code);
-        $this->assertArrayHasKey('redirect_uri', $code);
-        $this->assertArrayHasKey('expires', $code);
-        $this->assertEquals($code['authorization_code'], 'newcode');
-        $this->assertEquals($code['client_id'], 'client ID');
-        $this->assertEquals($code['user_id'], 'SOMEUSERID');
-        $this->assertEquals($code['redirect_uri'], 'http://example.com');
-        $this->assertEquals($code['expires'], $expires);
-
-        // change existing code
-        $expires = time() + 42;
-        $success = $storage->setAuthorizationCode('newcode', 'client ID2', 'SOMEOTHERID', 'http://example.org', $expires);
-        $this->assertTrue($success);
-
-        $code = $storage->getAuthorizationCode('newcode');
-        $this->assertNotNull($code);
-        $this->assertArrayHasKey('authorization_code', $code);
-        $this->assertArrayHasKey('client_id', $code);
-        $this->assertArrayHasKey('user_id', $code);
-        $this->assertArrayHasKey('redirect_uri', $code);
-        $this->assertArrayHasKey('expires', $code);
-        $this->assertEquals($code['authorization_code'], 'newcode');
-        $this->assertEquals($code['client_id'], 'client ID2');
-        $this->assertEquals($code['user_id'], 'SOMEOTHERID');
-        $this->assertEquals($code['redirect_uri'], 'http://example.org');
-        $this->assertEquals($code['expires'], $expires);
-    }
-
-    /** @dataProvider provideStorage */
-    public function testCheckUserCredentials($storage)
-    {
-        if (is_null($storage)) {
-            $this->markTestSkipped('Unable to load class Mongo_Client');
-            return;
-        }
-        // create a new user for testing
-        $success = $storage->setUser('testusername', 'testpass', 'Test', 'User');
-        $this->assertTrue($success);
-
-        // correct credentials
-        $this->assertTrue($storage->checkUserCredentials('testusername', 'testpass'));
-        // invalid password
-        $this->assertFalse($storage->checkUserCredentials('testusername', 'fakepass'));
-        // invalid username
-        $this->assertFalse($storage->checkUserCredentials('fakeusername', 'testpass'));
-
-        // invalid username
-        $this->assertFalse($storage->getUserDetails('fakeusername'));
-
-        // ensure all properties are set
-        $user = $storage->getUserDetails('testusername');
-        $this->assertTrue($user !== false);
-        $this->assertArrayHasKey('user_id', $user);
-        $this->assertArrayHasKey('first_name', $user);
-        $this->assertArrayHasKey('last_name', $user);
-        $this->assertEquals($user['user_id'], 'testusername');
-        $this->assertEquals($user['first_name'], 'Test');
-        $this->assertEquals($user['last_name'], 'User');
-    }
-
-    public function provideStorage()
-    {
-        $memory = Bootstrap::getInstance()->getMemoryStorage();
-        $mysql = Bootstrap::getInstance()->getMysqlPdo();
-        $sqlite = Bootstrap::getInstance()->getSqlitePdo();
-        $mongo = Bootstrap::getInstance()->getMongo();
-        $redis = Bootstrap::getInstance()->getRedisStorage();
-
-        // will add multiple storage types later
-        return array(
-            array($memory),
-            array($sqlite),
-            array($mysql),
-            array($mongo),
-            array($redis)
-        );
-    }
-}
diff --git a/test/config/keys/id_rsa b/test/config/keys/id_rsa
new file mode 100644
index 0000000..e8b9eff
--- /dev/null
+++ b/test/config/keys/id_rsa
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQC8fpi06NfVYHAOAnxNMVnTXr/ptsLsNjP+uAt2eO0cc5J9H5XV
+8lFVujOrRu/JWi1TDmAvOaf/6A3BphIA1Pwp0AAqlZdwizIum8j0KzpsGYH5qReN
+QDwF3oUSKMsQCCGCDHrDYifG/pRi9bN1ZVjEXPr35HJuBe+FQpZTs8DewwIDAQAB
+AoGARfNxNknmtx/n1bskZ/01iZRzAge6BLEE0LV6Q4gS7mkRZu/Oyiv39Sl5vUlA
++WdGxLjkBwKNjxGN8Vxw9/ASd8rSsqeAUYIwAeifXrHhj5DBPQT/pDPkeFnp9B1w
+C6jo+3AbBQ4/b0ONSIEnCL2xGGglSIAxO17T1ViXp7lzXPECQQDe63nkRdWM0OCb
+oaHQPT3E26224maIstrGFUdt9yw3yJf4bOF7TtiPLlLuHsTTge3z+fG6ntC0xG56
+1cl37C3ZAkEA2HdVcRGugNp/qmVz4LJTpD+WZKi73PLAO47wDOrYh9Pn2I6fcEH0
+CPnggt1ko4ujvGzFTvRH64HXa6aPCv1j+wJBAMQMah3VQPNf/DlDVFEUmw9XeBZg
+VHaifX851aEjgXLp6qVj9IYCmLiLsAmVa9rr6P7p8asD418nZlaHUHE0eDkCQQCr
+uxis6GMx1Ka971jcJX2X696LoxXPd0KsvXySMupv79yagKPa8mgBiwPjrnK+EPVo
+cj6iochA/bSCshP/mwFrAkBHEKPi6V6gb94JinCT7x3weahbdp6bJ6/nzBH/p9VA
+HoT1JtwNFhGv9BCjmDydshQHfSWpY9NxlccBKL7ITm8R
+-----END RSA PRIVATE KEY-----
\ No newline at end of file
diff --git a/test/config/keys/id_rsa.pub b/test/config/keys/id_rsa.pub
new file mode 100644
index 0000000..1ac15f5
--- /dev/null
+++ b/test/config/keys/id_rsa.pub
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICiDCCAfGgAwIBAgIBADANBgkqhkiG9w0BAQQFADA9MQswCQYDVQQGEwJVUzEL
+MAkGA1UECBMCVVQxITAfBgNVBAoTGFZpZ25ldHRlIENvcnBvcmF0aW9uIFNCWDAe
+Fw0xMTEwMTUwMzE4MjdaFw0zMTEwMTAwMzE4MjdaMD0xCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIEwJVVDEhMB8GA1UEChMYVmlnbmV0dGUgQ29ycG9yYXRpb24gU0JYMIGf
+MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8fpi06NfVYHAOAnxNMVnTXr/ptsLs
+NjP+uAt2eO0cc5J9H5XV8lFVujOrRu/JWi1TDmAvOaf/6A3BphIA1Pwp0AAqlZdw
+izIum8j0KzpsGYH5qReNQDwF3oUSKMsQCCGCDHrDYifG/pRi9bN1ZVjEXPr35HJu
+Be+FQpZTs8DewwIDAQABo4GXMIGUMB0GA1UdDgQWBBRe8hrEXm+Yim4YlD5Nx+1K
+vCYs9DBlBgNVHSMEXjBcgBRe8hrEXm+Yim4YlD5Nx+1KvCYs9KFBpD8wPTELMAkG
+A1UEBhMCVVMxCzAJBgNVBAgTAlVUMSEwHwYDVQQKExhWaWduZXR0ZSBDb3Jwb3Jh
+dGlvbiBTQliCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQQFAAOBgQBjhyRD
+lM7vnLn6drgQVftW5V9nDFAyPAuiGvMIKFSbiAf1PxXCRn5sfJquwWKsJUi4ZGNl
+aViXdFmN6/F13PSM+yg63tpKy0fYqMbTM+Oe5WuSHkSW1VuYNHV+24adgNk/FRDL
+FRrlM1f6s9VTLWvwGItjfrof0Ba8Uq7ZDSb9Xg==
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/test/config/storage.json b/test/config/storage.json
index db6f840..f2db151 100644
--- a/test/config/storage.json
+++ b/test/config/storage.json
@@ -48,6 +48,10 @@
         "Test Client ID Empty Secret": {
             "client_secret": ""
         },
+        "Client ID With User ID": {
+            "client_secret": "TestSecret",
+            "user_id": "brent@brentertainment.com"
+        },
         "oauth_test_client": {
             "client_secret": "testpass",
             "grant_types": "implicit password"
@@ -97,23 +101,32 @@
         }
     },
     "jwt": {
-	    "Test Client ID": {
-	        "key": "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5/SxVlE8gnpFqCxgl2wjhzY7u\ncEi00s0kUg3xp7lVEvgLgYcAnHiWp+gtSjOFfH2zsvpiWm6Lz5f743j/FEzHIO1o\nwR0p4d9pOaJK07d01+RzoQLOIQAgXrr4T1CCWUesncwwPBVCyy2Mw3Nmhmr9MrF8\nUlvdRKBxriRnlP3qJQIDAQAB\n-----END PUBLIC KEY-----",
-	        "subject": "testuser@ourdomain.com"
-	    },
-	    "Test Client ID PHP-5.2": {
-	        "key": "mysecretkey",
-	        "subject": "testuser@ourdomain.com"
-	    },
-	    "Missing Key Client": {
-	        "key": null,
-	        "subject": "testuser@ourdomain.com"
-	    },
-	    "Missing Key Client PHP-5.2": {
-	        "key": null,
-	        "subject": "testuser@ourdomain.com"
-	    }
+        "Test Client ID": {
+            "key": "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5/SxVlE8gnpFqCxgl2wjhzY7u\ncEi00s0kUg3xp7lVEvgLgYcAnHiWp+gtSjOFfH2zsvpiWm6Lz5f743j/FEzHIO1o\nwR0p4d9pOaJK07d01+RzoQLOIQAgXrr4T1CCWUesncwwPBVCyy2Mw3Nmhmr9MrF8\nUlvdRKBxriRnlP3qJQIDAQAB\n-----END PUBLIC KEY-----",
+            "subject": "testuser@ourdomain.com"
+        },
+        "Test Client ID PHP-5.2": {
+            "key": "mysecretkey",
+            "subject": "testuser@ourdomain.com"
+        },
+        "Missing Key Client": {
+            "key": null,
+            "subject": "testuser@ourdomain.com"
+        },
+        "Missing Key Client PHP-5.2": {
+            "key": null,
+            "subject": "testuser@ourdomain.com"
+        }
     },
+    "jti": [
+        {
+            "issuer": "Test Client ID",
+            "subject": "testuser@ourdomain.com",
+            "audience": "http://myapp.com/oauth/auth",
+            "expires": 99999999900,
+            "jti": "used_jti"
+        }
+    ],
     "client_supported_scopes" : {
         "Test Client ID" : ["clientscope1", "clientscope2"],
         "Test Client ID 2" : ["clientscope3"]
@@ -125,6 +138,14 @@
     "supported_scopes" : [
         "scope1",
         "scope2",
-        "scope3"
-    ]
+        "scope3",
+        "supportedscope1",
+        "supportedscope2",
+        "supportedscope3",
+        "supportedscope4"
+    ],
+    "keys": {
+        "public_key": "-----BEGIN CERTIFICATE-----\nMIICiDCCAfGgAwIBAgIBADANBgkqhkiG9w0BAQQFADA9MQswCQYDVQQGEwJVUzEL\nMAkGA1UECBMCVVQxITAfBgNVBAoTGFZpZ25ldHRlIENvcnBvcmF0aW9uIFNCWDAe\nFw0xMTEwMTUwMzE4MjdaFw0zMTEwMTAwMzE4MjdaMD0xCzAJBgNVBAYTAlVTMQsw\nCQYDVQQIEwJVVDEhMB8GA1UEChMYVmlnbmV0dGUgQ29ycG9yYXRpb24gU0JYMIGf\nMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8fpi06NfVYHAOAnxNMVnTXr/ptsLs\nNjP+uAt2eO0cc5J9H5XV8lFVujOrRu/JWi1TDmAvOaf/6A3BphIA1Pwp0AAqlZdw\nizIum8j0KzpsGYH5qReNQDwF3oUSKMsQCCGCDHrDYifG/pRi9bN1ZVjEXPr35HJu\nBe+FQpZTs8DewwIDAQABo4GXMIGUMB0GA1UdDgQWBBRe8hrEXm+Yim4YlD5Nx+1K\nvCYs9DBlBgNVHSMEXjBcgBRe8hrEXm+Yim4YlD5Nx+1KvCYs9KFBpD8wPTELMAkG\nA1UEBhMCVVMxCzAJBgNVBAgTAlVUMSEwHwYDVQQKExhWaWduZXR0ZSBDb3Jwb3Jh\ndGlvbiBTQliCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQQFAAOBgQBjhyRD\nlM7vnLn6drgQVftW5V9nDFAyPAuiGvMIKFSbiAf1PxXCRn5sfJquwWKsJUi4ZGNl\naViXdFmN6/F13PSM+yg63tpKy0fYqMbTM+Oe5WuSHkSW1VuYNHV+24adgNk/FRDL\nFRrlM1f6s9VTLWvwGItjfrof0Ba8Uq7ZDSb9Xg==\n-----END CERTIFICATE-----",
+        "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIICXQIBAAKBgQC8fpi06NfVYHAOAnxNMVnTXr/ptsLsNjP+uAt2eO0cc5J9H5XV\n8lFVujOrRu/JWi1TDmAvOaf/6A3BphIA1Pwp0AAqlZdwizIum8j0KzpsGYH5qReN\nQDwF3oUSKMsQCCGCDHrDYifG/pRi9bN1ZVjEXPr35HJuBe+FQpZTs8DewwIDAQAB\nAoGARfNxNknmtx/n1bskZ/01iZRzAge6BLEE0LV6Q4gS7mkRZu/Oyiv39Sl5vUlA\n+WdGxLjkBwKNjxGN8Vxw9/ASd8rSsqeAUYIwAeifXrHhj5DBPQT/pDPkeFnp9B1w\nC6jo+3AbBQ4/b0ONSIEnCL2xGGglSIAxO17T1ViXp7lzXPECQQDe63nkRdWM0OCb\noaHQPT3E26224maIstrGFUdt9yw3yJf4bOF7TtiPLlLuHsTTge3z+fG6ntC0xG56\n1cl37C3ZAkEA2HdVcRGugNp/qmVz4LJTpD+WZKi73PLAO47wDOrYh9Pn2I6fcEH0\nCPnggt1ko4ujvGzFTvRH64HXa6aPCv1j+wJBAMQMah3VQPNf/DlDVFEUmw9XeBZg\nVHaifX851aEjgXLp6qVj9IYCmLiLsAmVa9rr6P7p8asD418nZlaHUHE0eDkCQQCr\nuxis6GMx1Ka971jcJX2X696LoxXPd0KsvXySMupv79yagKPa8mgBiwPjrnK+EPVo\ncj6iochA/bSCshP/mwFrAkBHEKPi6V6gb94JinCT7x3weahbdp6bJ6/nzBH/p9VA\nHoT1JtwNFhGv9BCjmDydshQHfSWpY9NxlccBKL7ITm8R\n-----END RSA PRIVATE KEY-----"
+    }
 }
\ No newline at end of file
diff --git a/test/lib/OAuth2/Request/TestRequest.php b/test/lib/OAuth2/Request/TestRequest.php
index aa471f2..5e0d081 100644
--- a/test/lib/OAuth2/Request/TestRequest.php
+++ b/test/lib/OAuth2/Request/TestRequest.php
@@ -58,6 +58,7 @@ class TestRequest implements RequestInterface
     {
         $request = new self();
         $request->setPost($params);
+
         return $request;
     }
 }
diff --git a/test/lib/OAuth2/Storage/BaseTest.php b/test/lib/OAuth2/Storage/BaseTest.php
new file mode 100644
index 0000000..2b09265
--- /dev/null
+++ b/test/lib/OAuth2/Storage/BaseTest.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace OAuth2\Storage;
+
+abstract class BaseTest extends \PHPUnit_Framework_TestCase
+{
+    public function provideStorage()
+    {
+        $mysql = Bootstrap::getInstance()->getMysqlPdo();
+        $sqlite = Bootstrap::getInstance()->getSqlitePdo();
+        $mongo = Bootstrap::getInstance()->getMongo();
+        $redis = Bootstrap::getInstance()->getRedisStorage();
+
+        /* hack until we can fix "default_scope" dependencies in other tests */
+        // $memory = Bootstrap::getInstance()->getMemoryStorage();
+        $memoryConfig = json_decode(file_get_contents(__DIR__.'/../../../config/storage.json'), true);
+        $memoryConfig['default_scope'] = 'defaultscope1 defaultscope2';
+        $memory = new Memory($memoryConfig);
+
+        // will add multiple storage types later
+        return array(
+            array($memory),
+            array($sqlite),
+            array($mysql),
+            array($mongo),
+            array($redis)
+        );
+    }
+}
diff --git a/test/lib/OAuth2/Storage/Bootstrap.php b/test/lib/OAuth2/Storage/Bootstrap.php
index 9b0839f..673a01a 100644
--- a/test/lib/OAuth2/Storage/Bootstrap.php
+++ b/test/lib/OAuth2/Storage/Bootstrap.php
@@ -8,12 +8,19 @@ class Bootstrap
     private $mysql;
     private $sqlite;
     private $mongo;
+    private $configDir;
+
+    public function __construct()
+    {
+        $this->configDir = __DIR__.'/../../../config';
+    }
 
     public static function getInstance()
     {
         if (!self::$instance) {
             self::$instance = new self();
         }
+
         return self::$instance;
     }
 
@@ -27,12 +34,13 @@ class Bootstrap
 
             $this->sqlite = new Pdo($pdo);
         }
+
         return $this->sqlite;
     }
 
     public function getMemoryStorage()
     {
-        return new Memory(json_decode(file_get_contents(dirname(__FILE__).'/../../../config/storage.json'), true));
+        return new Memory(json_decode(file_get_contents($this->configDir. '/storage.json'), true));
     }
 
     public function getRedisStorage()
@@ -50,6 +58,7 @@ class Bootstrap
 
             $this->mysql = new Pdo($pdo);
         }
+
         return $this->mysql;
     }
 
@@ -66,22 +75,13 @@ class Bootstrap
                 $this->mongo = new Mongo($db);
             }
         }
+
         return $this->mongo;
     }
 
     private function createSqliteDb(\PDO $pdo)
     {
-        $pdo->exec('CREATE TABLE oauth_clients (client_id TEXT, client_secret TEXT, redirect_uri TEXT, grant_types TEXT)');
-        $pdo->exec('CREATE TABLE oauth_access_tokens (access_token TEXT, client_id TEXT, user_id TEXT, expires TIMESTAMP, scope TEXT)');
-        $pdo->exec('CREATE TABLE oauth_authorization_codes (authorization_code TEXT, client_id TEXT, user_id TEXT, redirect_uri TEXT, expires TIMESTAMP, scope TEXT)');
-        $pdo->exec('CREATE TABLE oauth_users (username TEXT, password TEXT, first_name TEXT, last_name TEXT)');
-        $pdo->exec('CREATE TABLE oauth_refresh_tokens (refresh_token TEXT, client_id TEXT, user_id TEXT, expires TIMESTAMP, scope TEXT)');
-
-        // test data
-        $pdo->exec('INSERT INTO oauth_clients (client_id, client_secret, grant_types) VALUES ("oauth_test_client", "testpass", "implicit password")');
-        $pdo->exec('INSERT INTO oauth_access_tokens (access_token, client_id) VALUES ("testtoken", "Some Client")');
-        $pdo->exec('INSERT INTO oauth_authorization_codes (authorization_code, client_id) VALUES ("testcode", "Some Client")');
-        $pdo->exec('INSERT INTO oauth_users (username, password) VALUES ("testuser", "password")');
+        $this->runPdoSql($pdo);
     }
 
     private function removeSqliteDb()
@@ -95,17 +95,45 @@ class Bootstrap
     {
         $pdo->exec('CREATE DATABASE oauth2_server_php');
         $pdo->exec('USE oauth2_server_php');
-        $pdo->exec('CREATE TABLE oauth_clients (client_id TEXT, client_secret TEXT, redirect_uri TEXT, grant_types TEXT)');
+        $this->runPdoSql($pdo);
+    }
+
+    public function runPdoSql(\PDO $pdo)
+    {
+        $pdo->exec('CREATE TABLE oauth_clients (client_id TEXT, client_secret TEXT, redirect_uri TEXT, grant_types TEXT, user_id TEXT)');
         $pdo->exec('CREATE TABLE oauth_access_tokens (access_token TEXT, client_id TEXT, user_id TEXT, expires DATETIME, scope TEXT)');
         $pdo->exec('CREATE TABLE oauth_authorization_codes (authorization_code TEXT, client_id TEXT, user_id TEXT, redirect_uri TEXT, expires DATETIME, scope TEXT)');
         $pdo->exec('CREATE TABLE oauth_users (username TEXT, password TEXT, first_name TEXT, last_name TEXT)');
         $pdo->exec('CREATE TABLE oauth_refresh_tokens (refresh_token TEXT, client_id TEXT, user_id TEXT, expires DATETIME, scope TEXT)');
-
-        // test data
+        $pdo->exec('CREATE TABLE oauth_scopes (type TEXT, scope TEXT, client_id TEXT)');
+        $pdo->exec('CREATE TABLE oauth_public_keys (client_id TEXT, public_key TEXT, private_key TEXT, encryption_algorithm VARCHAR(100) DEFAULT "RS256")');
+
+        // set up scopes
+        $pdo->exec('INSERT INTO oauth_scopes (type, scope) VALUES ("supported", "supportedscope1 supportedscope2 supportedscope3 supportedscope4")');
+        $pdo->exec('INSERT INTO oauth_scopes (type, scope) VALUES ("default", "defaultscope1 defaultscope2")');
+        $pdo->exec('INSERT INTO oauth_scopes (type, scope, client_id) VALUES ("supported", "clientscope1 clientscope2", "Test Client ID")');
+        $pdo->exec('INSERT INTO oauth_scopes (type, scope, client_id) VALUES ("default", "clientscope1 clientscope2", "Test Client ID")');
+        $pdo->exec('INSERT INTO oauth_scopes (type, scope, client_id) VALUES ("supported", "clientscope1 clientscope2 clientscope3", "Test Client ID 2")');
+        $pdo->exec('INSERT INTO oauth_scopes (type, scope, client_id) VALUES ("default", "clientscope1 clientscope2", "Test Client ID 2")');
+        $pdo->exec('INSERT INTO oauth_scopes (type, scope, client_id) VALUES ("supported", "clientscope1 clientscope2", "Test Default Scope Client ID")');
+        $pdo->exec('INSERT INTO oauth_scopes (type, scope, client_id) VALUES ("default", "clientscope1 clientscope2", "Test Default Scope Client ID")');
+        $pdo->exec('INSERT INTO oauth_scopes (type, scope, client_id) VALUES ("supported", "clientscope1 clientscope2 clientscope3", "Test Default Scope Client ID 2")');
+        $pdo->exec('INSERT INTO oauth_scopes (type, scope, client_id) VALUES ("default", "clientscope3", "Test Default Scope Client ID 2")');
+
+        // set up clients
+        $pdo->exec('INSERT INTO oauth_clients (client_id, client_secret) VALUES ("Test Client ID", "TestSecret")');
+        $pdo->exec('INSERT INTO oauth_clients (client_id, client_secret) VALUES ("Test Client ID 2", "TestSecret")');
+        $pdo->exec('INSERT INTO oauth_clients (client_id, client_secret) VALUES ("Test Default Scope Client ID", "TestSecret")');
+        $pdo->exec('INSERT INTO oauth_clients (client_id, client_secret) VALUES ("Test Default Scope Client ID 2", "TestSecret")');
         $pdo->exec('INSERT INTO oauth_clients (client_id, client_secret, grant_types) VALUES ("oauth_test_client", "testpass", "implicit password")');
+
+        // set up misc
         $pdo->exec('INSERT INTO oauth_access_tokens (access_token, client_id) VALUES ("testtoken", "Some Client")');
         $pdo->exec('INSERT INTO oauth_authorization_codes (authorization_code, client_id) VALUES ("testcode", "Some Client")');
         $pdo->exec('INSERT INTO oauth_users (username, password) VALUES ("testuser", "password")');
+        $pdo->exec('INSERT INTO oauth_public_keys (client_id, public_key, private_key, encryption_algorithm) VALUES ("ClientID_One", "client_1_public", "client_1_private", "RS256")');
+        $pdo->exec('INSERT INTO oauth_public_keys (client_id, public_key, private_key, encryption_algorithm) VALUES ("ClientID_Two", "client_2_public", "client_2_private", "RS256")');
+        $pdo->exec(sprintf('INSERT INTO oauth_public_keys (client_id, public_key, private_key, encryption_algorithm) VALUES (NULL, "%s", "%s", "RS256")', file_get_contents($this->configDir.'/keys/id_rsa.pub'), file_get_contents($this->configDir.'/keys/id_rsa')));
     }
 
     public function removeMysqlDb(\PDO $pdo)
@@ -113,9 +141,14 @@ class Bootstrap
         $pdo->exec('DROP DATABASE IF EXISTS oauth2_server_php');
     }
 
-    private function getSqliteDir()
+    public function getSqliteDir()
+    {
+        return $this->configDir. '/test.sqlite';
+    }
+
+    public function getConfigDir()
     {
-        return dirname(__FILE__).'/../../../config/test.sqlite';
+        return $this->configDir;
     }
 
     private function createMongoDb(\MongoDB $db)
diff --git a/test/lib/OAuth2/Storage/MockRedisClient.php b/test/lib/OAuth2/Storage/MockRedisClient.php
index 75dde33..dbfe264 100644
--- a/test/lib/OAuth2/Storage/MockRedisClient.php
+++ b/test/lib/OAuth2/Storage/MockRedisClient.php
@@ -13,6 +13,22 @@ class MockRedisClient
                 'redirect_uri' => '',
                 'grant_types' => 'implicit password',
             ),
+            'oauth_clients:Test Client ID' => array(
+                'client_id' => 'Test Client ID',
+                'client_secret' => "TestSecret"
+            ),
+            'oauth_clients:Test Client ID 2' => array(
+                'client_id' => 'Test Client ID 2',
+                'client_secret' => "TestSecret",
+            ),
+            'oauth_clients:Test Default Scope Client ID' => array(
+                'client_id' => 'Test Default Scope Client ID',
+                'client_secret' => "TestSecret",
+            ),
+            'oauth_clients:Test Default Scope Client ID 2' => array(
+                'client_id' => 'Test Default Scope Client ID 2',
+                'client_secret' => "TestSecret",
+            ),
             'oauth_access_tokens:testtoken' => array(
                 'access_token' => 'testtoken',
                 'client_id' => "Some Client",
@@ -33,35 +49,48 @@ class MockRedisClient
                 'password' => "password",
                 'first_name' => '',
                 'last_name' => ''
-            )
+            ),
+            'oauth_scopes:supported:global' => 'supportedscope1 supportedscope2 supportedscope3 supportedscope4',
+            'oauth_scopes:default:global' => 'defaultscope1 defaultscope2',
+            'oauth_scopes:supported:Test Client ID' => 'clientscope1 clientscope2',
+            'oauth_scopes:default:Test Client ID' => 'clientscope1 clientscope2',
+            'oauth_scopes:supported:Test Client ID 2' => 'clientscope3',
+            'oauth_scopes:default:Test Client ID 2' => 'clientscope3',
+            'oauth_scopes:supported:Test Default Scope Client ID' => 'clientscope1 clientscope2',
+            'oauth_scopes:default:Test Default Scope Client ID' => 'clientscope1 clientscope2',
+            'oauth_scopes:supported:Test Default Scope Client ID 2' => 'clientscope3',
+            'oauth_scopes:default:Test Default Scope Client ID 2' => 'clientscope3',
         );
-        foreach ( $data as $name => $val ) {
+        foreach ($data as $name => $val) {
             $data[$name] = json_encode($val);
         }
         $this->data = $data;
     }
 
-    function get($key)
+    public function get($key)
     {
         return isset($this->data[$key]) ? $this->data[$key] : null;
     }
 
-    function set ($key, $value)
+    public function set ($key, $value)
     {
         $this->data[$key] = $value;
+
         return true;
     }
 
-    function setex($key, $expires, $value)
+    public function setex($key, $expires, $value)
     {
 
         $this->data[$key] = $value;
+
         return true;
     }
 
-    function expire($key)
+    public function expire($key)
     {
         unset($this->data[$key]);
+
         return true;
     }
 }