spectare/fakeidp repository overview

⁠FakeIdp - OIDC based login for automated and manual testing

This is a HTTP(S) based service with a valid key and discovery endpoint that allows to generate JWT tokens based on the claims you like to receive.

⁠Running the service

docker run -p9090:9090 -e BIND=0.0.0.0 -e PORT=9090  -e EXPOSED_HOST=http://localhost:9090 spectare/fakeidp:latest

where BIND and PORT are environment variables that allow you to change the endpoint binding and address within the container. Note that you need to expose the port you choose.

⁠Example

The service runs with the above docker run on port 9090 and in order to generate a token, you post the required claimset to the /token endpoint

curl -d "@claim.json" -X POST http://`hostname -f`:9090/token

where claim.json contains the claimset:

{
  "iss": "http://localhost:9090/mock",
  "sub": "CgVhZG1pbhIFbG9jYWw",
  "aud": "cafienne-ui",
  "exp": 1576568495,
  "iat": 1576482095,
  "at_hash": "zqKhL-sV6TNJUFQSF7PwLQ",
  "email": "[email protected]",
  "email_verified": true,
  "name": "admin"
}

Example for userinfo

When you need to mock your userinfo call, you can create a token with the above example and thereafter do a GET on the /userinfo enpoint with an 'Authorization' header including 'Bearer ' where is the generated token of the example.

Note that your claims need to contain the fields you want to return for userinfo. Currently supported are:

{ "iss": "http://localhost:8080⁠", "sub": "F82E617D-DEAF-4EE6-8F96-CF3409060CA2", "email": "[email protected]⁠", "email_verified": true, "name": "Arie Ministrone" } Name, email and email_verified. The other 2 are required for generation of the token and are used in the validation.

⁠Use it for manual OIDC Login

At this moment it is possible to use a simple implicit flow (response_type=token%20id_token&scope=openid) and trigger a login screen. Within the screen you can setup your sub(ject) - most of the times your account ID and your name. the .well-known/openid-configuration endpoint returns the proper authorization endpoint (/auth)

NOTE: PKCE FLOW IS NOT YET SUPPORTED