idemtoken

IdemToken

A stateless, deterministic Mock Identity Provider (OIDC/JWKS) for local testing and CI/CD environments.

No database. No disk. No config files. RSA key pairs and JWTs are generated on-the-fly, deterministically from the URL path — the same path always returns the same key and token structure.

How it works

The URL path /i/{namespace}/{client} is the sole input. A SHA-256 hash of namespace/client seeds a math/rand source, which drives deterministic RSA-2048 key generation (bypassing crypto/rand). The hex-encoded hash becomes the kid.

Build & Run

Local

go build -o idemtoken .
./idemtoken          # listens on :8080
PORT=9090 ./idemtoken

Docker

docker build -t idemtoken .
docker run -p 8080:8080 idemtoken

API Reference

The namespace scopes the issuer and its signing key. The client is only used as the aud claim in tokens.

/i/{namespace}/.well-known/openid-configuration   ← issuer discovery
/i/{namespace}/.well-known/jwks.json              ← public key (shared by all clients)
/i/{namespace}/{client}/token                     ← mint a token for this client

Health check

curl http://localhost:8080/healthz
# 200 OK

OIDC Discovery

curl http://localhost:8080/i/local/.well-known/openid-configuration

{
  "issuer": "http://localhost:8080/i/local",
  "jwks_uri": "http://localhost:8080/i/local/.well-known/jwks.json",
  "response_types_supported": ["id_token"],
  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": ["RS256"]
}

JWKS (public key)

curl http://localhost:8080/i/local/.well-known/jwks.json

Mint a token (defaults)

curl http://localhost:8080/i/local/my-service/token

Default claims: iss = issuer URL, aud = {client}, sub = idem-default-user, iat = now, exp = now + 1h.

Multiple clients share the same issuer and signing key — their tokens differ only in aud:

curl http://localhost:8080/i/local/service-a/token
curl http://localhost:8080/i/local/service-b/token
# Same iss, same kid, different aud

Mint a token (custom claims via POST)

curl -X POST http://localhost:8080/i/local/my-service/token \
  -H 'Content-Type: application/json' \
  -d '{"sub": "alice", "roles": ["admin"], "exp": 9999999999}'

Custom claims overwrite defaults. Any JSON key is accepted.

Verify a token

TOKEN=$(curl -s http://localhost:8080/i/local/my-service/token | jq -r .access_token)

# Using jwt-cli (https://github.com/mike-engel/jwt-cli)
jwt decode "$TOKEN"

# Manual verification: fetch the JWKS and validate the signature
curl -s http://localhost:8080/i/local/.well-known/jwks.json

Kubernetes / CI usage

# k8s deployment snippet
- name: OIDC_ISSUER
  value: "http://idemtoken/i/ci"
- name: JWKS_URI
  value: "http://idemtoken/i/ci/.well-known/jwks.json"

Configure your service under test to trust the issuer URL above. IdemToken will consistently return the same public key for that namespace, so JWKS caching in your service will work correctly across restarts.