SSOJet Releases mock-idp, an Open-Source Tool That Simulates Okta, Microsoft Entra ID & Seven Other Identity Providers

Developers can test SAML, OIDC and SCIM integrations without a vendor test tenant, then inject 40 faults to check that their apps reject broken logins

SAN FRANCISCO, CA, UNITED STATES, October 27, 2026 /EINPresswire.com/ — SSOJet, which provides enterprise single sign-on and directory sync for B2B SaaS companies, today released mock-idp, a free, open-source identity provider simulator for testing enterprise login. mock-idp runs nine identity providers in a single Docker container: Okta, Microsoft Entra ID, Google Workspace, OneLogin, PingOne, JumpCloud, Microsoft AD FS, Auth0 and Keycloak.

Software companies that sell to enterprises are routinely asked to support single sign-on (SSO) through their customers’ identity providers. Testing that work usually means requesting developer tenants, waiting on customers’ IT teams for app registrations, and exposing local servers to the internet to test user provisioning. Even then, teams can typically test only the “happy path”: a real identity provider will not send an expired assertion or a forged signature on request.

mock-idp is built to test both sides. Each simulated provider reproduces documented behaviors of the real service, such as Microsoft Entra ID issuing a different user identifier for each application and Okta using a different SAML issuer for each app. Developers can then switch on any of 40 faults, including expired assertions, XML signature-wrapping attacks, unsigned tokens, unknown signing keys, clock skew and an identity provider that returns errors, and confirm that their application rejects the login.

“Most teams only find out how their SSO fails when a customer’s identity provider does something unexpected in production,” said Daven Patel, Head of Product at SSOJet. “We built mock-idp to test our own integrations against every provider quirk and failure we could think of. We’re releasing it so any team selling to enterprises can do the same before their customers’ security reviews do it for them.”

To show why fault testing matters, SSOJet ran four widely used open-source SSO libraries for Node.js and Go against 35 of the faults. The libraries rejected most of them, including signature-wrapping attacks. Several gaps remained that applications must close themselves: in their default configurations, one library accepted a tampered ID token, one did not check the issuer of a SAML login response, and neither SAML library tested rejected SHA-1 signatures. SSOJet shared the findings with the library maintainers before publication. The full results and fixes are published in the project’s documentation.

Key features of mock-idp include:
• SAML 2.0 identity provider with encrypted assertions, signed authentication requests and single logout
• OpenID Connect provider with authorization code flow and PKCE, refresh tokens and client credentials
• SCIM provisioning client that pushes users and groups into an application the way Okta or Microsoft Entra ID does, with a conformance test suite
• Live logs that decode every SAML response and JSON Web Token
• A JSON API and an MCP server, so continuous-integration pipelines and AI agents can create tenants, inject faults and read results

mock-idp is available now under the MIT license. It runs on Intel and Arm machines with one command: docker run -p 7070:7070 ghcr.io/ssojet/mock-idp. The source code and documentation are at github.com/ssojet/mock-idp.

About SSOJet
SSOJet provides a turnkey solution for B2B SaaS companies to integrate any SSO provider. Its platform includes single sign-on over SAML 2.0 and OIDC, directory sync with SCIM, an admin portal, MFA and passkeys, and audit logs, and it supports more than 100 identity providers. SSOJet is based in San Francisco. Learn more at ssojet.com.

Okta, Microsoft Entra ID, Google Workspace, OneLogin, PingOne, JumpCloud, Auth0 and Keycloak are trademarks of their respective owners. mock-idp is an independent testing tool and is not affiliated with or endorsed by these companies.

Media Team
SSOJet
+1 833-776-7763
media@ssojet.com
Visit us on social media:
LinkedIn
Bluesky
Instagram
YouTube
X
Other

Test SSO without an Okta tenant: mock-idp in 3 minutes

Media gallery