Enterprise software vendors know the drill: a customer demands single sign-on, and the engineering team braces for weeks of back-and-forth with vendor tenants and IT departments. SSOJet’s new open-source tool aims to compress that pain into a single Docker command.
SSOJet Dashboard
SSOJet – mock-idp
Also worth a look: Data lineage tools market to top $5B by 2030 as IBM leads a fragmented field and Automotive simulation software market heads to $9B as North America takes the lead.
Developers can test SAML, OIDC and SCIM integrations without a vendor test tenant, then inject 40 faults to check that their apps reject broken logins
We built mock-idp to test our own integrations against every provider quirk and failure we could think of. We’re releasing it so any team selling to enterprises can do the same.”— Daven Patel, Head of Product at SSOJetSAN FRANCISCO, CA, UNITED STATES, October 27, 2026 /EINPresswire.com/ — SSOJet, a provider of enterprise single sign-on and directory sync for B2B SaaS companies, has unveiled mock-idp, a free and open-source identity provider simulator designed for testing enterprise login flows. The tool runs nine identity providers inside a single Docker container: Okta, Microsoft Entra ID, Google Workspace, OneLogin, PingOne, JumpCloud, Microsoft AD FS, Auth0 and Keycloak.
Companies selling software to large organizations are almost always asked to support single sign-on through their customers’ identity providers. Traditionally, that work requires requesting developer tenants, coordinating with customers’ IT teams for app registrations, and exposing local servers to the internet to test user provisioning. Even under the best circumstances, teams usually can only test the “happy path”: a real identity provider won’t send an expired assertion or a forged signature on demand.
mock-idp is designed to test both the expected and the broken. Each simulated provider mirrors documented behaviors of the actual service, such as Microsoft Entra ID issuing a different user identifier for each application and Okta using a distinct SAML issuer for each app. Developers can activate any of 40 faults—including expired assertions, XML signature-wrapping attacks, unsigned tokens, unknown signing keys, clock skew, and an identity provider that returns errors—and verify that their application rejects the login.
“Most teams only find out how their SSO fails when a customer’s identity provider does something unexpected in production,” said Daven Patel, Head of Product at SSOJet. “We built mock-idp to test our own integrations against every provider quirk and failure we could think of. We’re releasing it so any team selling to enterprises can do the same before their customers’ security reviews do it for them.”
To demonstrate the importance of fault testing, SSOJet ran four widely used open-source SSO libraries for Node.js and Go against 35 of the faults. The libraries rejected most of them, including signature-wrapping attacks. However, several gaps remained that applications must address themselves: in their default configurations, one library accepted a tampered ID token, one did not check the issuer of a SAML login response, and neither SAML library tested rejected SHA-1 signatures. SSOJet shared the findings with the library maintainers before publication. The full results and fixes are published in the project’s documentation.
Key features of mock-idp include:
• SAML 2.0 identity provider with encrypted assertions, signed authentication requests and single logout
• OpenID Connect provider with authorization code flow and PKCE, refresh tokens and client credentials
• SCIM provisioning client that pushes users and groups into an application the way Okta or Microsoft Entra ID does, with a conformance test suite
• Live logs that decode every SAML response and JSON Web Token
• A JSON API and an MCP server, so continuous-integration pipelines and AI agents can create tenants, inject faults and read results
mock-idp is available now under the MIT license. It runs on Intel and Arm machines with one command: docker run -p 7070:7070 ghcr.io/ssojet/mock-idp. The source code and documentation are at github.com/ssojet/mock-idp.
About SSOJet
SSOJet provides a turnkey solution for B2B SaaS companies to integrate any SSO provider. Its platform includes single sign-on over SAML 2.0 and OIDC, directory sync with SCIM, an admin portal, MFA and passkeys, and audit logs, and it supports more than 100 identity providers. SSOJet is based in San Francisco. Learn more at ssojet.com.
Okta, Microsoft Entra ID, Google Workspace, OneLogin, PingOne, JumpCloud, Auth0 and Keycloak are trademarks of their respective owners. mock-idp is an independent testing tool and is not affiliated with or endorsed by these companies.
Media Team
SSOJet
+1 833-776-7763
media@ssojet.com
Visit us on social media:
LinkedIn
Bluesky
Instagram
YouTube
X
Other
Test SSO without an Okta tenant: mock-idp in 3 minutes
Why it matters: For B2B SaaS teams, the gap between “it works in our sandbox” and “it works with a customer’s real identity provider” has long been a source of production failures and tense security reviews. By giving developers a way to simulate both standard behavior and malicious or broken inputs before deployment, tools like mock-idp could shorten sales cycles and reduce the risk of enterprise customers discovering SSO flaws the hard way.
