https://github.com/hectorm/simpleidp
Minimal OIDC Identity Provider for testing.
https://github.com/hectorm/simpleidp
Last synced: about 2 months ago
JSON representation
Minimal OIDC Identity Provider for testing.
- Host: GitHub
- URL: https://github.com/hectorm/simpleidp
- Owner: hectorm
- License: mit
- Created: 2026-05-03T20:54:19.000Z (3 months ago)
- Default Branch: master
- Last Pushed: 2026-05-03T23:38:36.000Z (3 months ago)
- Last Synced: 2026-05-04T01:25:53.797Z (3 months ago)
- Language: Go
- Homepage:
- Size: 69.3 KB
- Stars: 1
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
# Simple IdP
Minimal OIDC Identity Provider that implements the Authorization Code flow with PKCE.
## Why
I need an IdP for local development and integration testing. Keycloak is more than capable, but too complex for this specific use case, and Dex, while lighter, doesn't implement everything I need for testing. So, with the help of an LLM, I've developed this simple IdP. This isn't strictly "vibe-coded" because I at least guided and verified the low-level implementation, but naturally, this shouldn't be used for any production purposes. It was developed solely to address a use case of my own. If you find this useful, go ahead and use it, but I consider this finished unless I find a bug or need to extend the implementation.
## Configuration
All configuration is done through environment variables. At least one client and one user must be configured.
### General
| Variable | Description |
| --------------------- | ---------------------------------------------------------------- |
| `SIMPLE_IDP_LISTEN` | Listen address (default `:8227`) |
| `SIMPLE_IDP_ISSUER` | Issuer URL as seen by clients (required) |
| `SIMPLE_IDP_TITLE` | Login page title (default `Simple IdP`) |
| `SIMPLE_IDP_KEY_ID` | JWKS key ID (default `simple-idp`) |
| `SIMPLE_IDP_KEY_FILE` | PEM file for PKCS8 RSA private key; generated in memory if empty |
| `SIMPLE_IDP_KEY_B64` | Base64-encoded PKCS8 RSA private key (alternative to `KEY_FILE`) |
### Clients
Clients are configured with a label prefix. The label is arbitrary and only used for grouping.
| Variable | Description |
| --------------------------------------------------------------- | --------------------------------------------------------- |
| `SIMPLE_IDP_CLIENT__ID` | Client ID |
| `SIMPLE_IDP_CLIENT__SECRET` | Client secret (optional for loopback/native clients) |
| `SIMPLE_IDP_CLIENT__REDIRECT_URL` | Allowed redirect URI |
| `SIMPLE_IDP_CLIENT__POST_LOGOUT_REDIRECT_URL` | Allowed post-logout redirect URI (optional) |
| `SIMPLE_IDP_CLIENT__BACKCHANNEL_LOGOUT_URI` | Back-channel logout URI (optional) |
| `SIMPLE_IDP_CLIENT__BACKCHANNEL_LOGOUT_SESSION_REQUIRED` | Require `sid` in logout token (optional, default `false`) |
### Users
Users are configured the same way as clients, with a label prefix.
| Variable | Description |
| -------------------------------------------- | -------------------------------------------------- |
| `SIMPLE_IDP_USER__USERNAME` | Login username (required) |
| `SIMPLE_IDP_USER__PASSWORD` | Login password (required) |
| `SIMPLE_IDP_USER__SUB` | `sub` claim (default: ``) |
| `SIMPLE_IDP_USER__NAME` | `name` claim (default: ``) |
| `SIMPLE_IDP_USER__PREFERRED_USERNAME` | `preferred_username` claim (default: ``) |
| `SIMPLE_IDP_USER__EMAIL` | `email` claim (default: `@localhost`) |
| `SIMPLE_IDP_USER__EMAIL_VERIFIED` | `email_verified` claim (default: `true`) |
| `SIMPLE_IDP_USER__PROFILE` | `profile` claim (default: empty) |
| `SIMPLE_IDP_USER__PICTURE` | `picture` claim (default: empty) |
| `SIMPLE_IDP_USER__LOCALE` | `locale` claim (default: empty) |
| `SIMPLE_IDP_USER__GROUPS` | Comma-separated `groups` claim (default: empty) |