OIDC Testing Strategies — Mock Providers, Token Generators, and Integration Tests

In this tutorial, you will learn about OIDC Testing Strategies. We cover key concepts, practical examples, and best practices to help you master this topic.

Testing OIDC authentication requires mock providers, test token generators, and automated integration tests that validate the entire flow without depending on a real production identity provider.

What You'll Learn

• How to set up a mock OIDC provider for local testing
• How to generate test ID tokens with controlled claims
• How to write automated integration tests for the OIDC flow

Why It Matters

Relying on a production OIDC provider during development creates slow feedback loops, dependency on network connectivity, and cannot test error scenarios like invalid tokens or provider downtime. A mock provider gives you full control over test conditions.

Real-World Use

DodaTech's CI/CD pipeline runs 200+ OIDC tests in under 30 seconds using a mock provider. The mock can simulate token expiration, invalid signatures, missing claims, and provider errors — scenarios impossible to test reliably against a live provider.

flowchart LR
    A["Test Suite"] -->|"1. Initiate login"| B["Mock OIDC Provider"]
    B -->|"2. Return test token"| C["App Under Test"]
    C -->|"3. Validate token"| D["Assert Result"]
    A -->|"4. Test error case"| B
    B -->|"5. Return invalid token"| C
    C -->|"6. Handle error"| D
    style B fill:#dbeafe,stroke:#2563eb
    style D fill:#bbf7d0,stroke:#16a34a

Setting Up a Mock OIDC Provider

from flask import Flask, jsonify, request
import jwt
import datetime
import secrets

mock_app = Flask(__name__)

# Generate a test RSA key pair (for testing only)
TEST_PRIVATE_KEY = """-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA...
-----END RSA PRIVATE KEY-----"""

TEST_PUBLIC_KEY = """-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----"""

JWKS = {
    "keys": [{
        "kty": "RSA",
        "use": "sig",
        "kid": "test-key-1",
        "n": "..."  # Base64url-encoded modulus
    }]
}

@mock_app.route("/.well-known/openid-configuration")
def discovery():
    return jsonify({
        "issuer": "http://localhost:5000",
        "authorization_endpoint": "http://localhost:5000/auth",
        "token_endpoint": "http://localhost:5000/token",
        "userinfo_endpoint": "http://localhost:5000/userinfo",
        "jwks_uri": "http://localhost:5000/jwks",
        "response_types_supported": ["code"],
        "subject_types_supported": ["public"],
        "id_token_signing_alg_values_supported": ["RS256"]
    })

@mock_app.route("/jwks")
def jwks():
    return jsonify(JWKS)

Generating Test Tokens

def generate_test_id_token(claims_override=None):
    now = datetime.datetime.utcnow()
    default_claims = {
        "iss": "http://localhost:5000",
        "sub": "test-user-123",
        "aud": "test-client-id",
        "exp": now + datetime.timedelta(hours=1),
        "iat": now,
        "auth_time": now,
        "nonce": "test-nonce-abc",
        "name": "Test User",
        "email": "test@example.com",
        "email_verified": True,
        "preferred_username": "testuser"
    }
    if claims_override:
        default_claims.update(claims_override)
    token = jwt.encode(
        default_claims,
        TEST_PRIVATE_KEY,
        algorithm="RS256",
        headers={"kid": "test-key-1"}
    )
    return token

# Generate a token with specific test conditions
def test_token_expired():
    return generate_test_id_token({
        "exp": datetime.datetime.utcnow() - datetime.timedelta(hours=1)
    })

def test_token_invalid_audience():
    return generate_test_id_token({
        "aud": "wrong-client-id"
    })

def test_token_missing_nonce():
    claims = generate_test_id_token()
    del claims["nonce"]
    return claims

Automated Integration Tests

import pytest
from your_app import create_app
from mock_oidc import mock_app, generate_test_id_token

@pytest.fixture
def client():
    app = create_app(testing=True)
    app.config["OIDC_ISSUER"] = "http://localhost:5000"
    app.config["OIDC_CLIENT_ID"] = "test-client-id"
    app.config["OIDC_CLIENT_SECRET"] = "test-secret"
    return app.test_client()

def test_successful_login(client):
    # Start OIDC flow
    response = client.get("/login")
    assert response.status_code == 302

    # Simulate callback with valid token
    valid_token = generate_test_id_token()
    response = client.get(f"/callback?code=test-code&state=test-state")
    assert response.status_code == 200

def test_expired_token_rejected(client):
    expired_token = test_token_expired()
    response = client.post("/verify", json={"token": expired_token})
    assert response.status_code == 401
    assert "token_expired" in response.json["error"]

Common Mistakes

1. Using Real Provider Credentials in Tests

Never use production client credentials in test environments. Use a mock provider with test-specific credentials.

2. Testing Only the Happy Path

Test providers can return expired tokens, invalid signatures, wrong issuers, and missing claims. Cover these error cases.

3. Hardcoding Token Values

Hardcoded test tokens expire or become invalid when the signing key changes. Generate tokens dynamically in test setup.

4. Not Testing the Discovery Document

Your application's OIDC configuration depends on the provider's discovery document. Test that your app correctly parses and uses each field.

5. Skipping Signature Verification in Tests

Some developers disable signature verification in tests for convenience. This misses critical validation logic bugs.

Practice Questions

1. Why use a mock OIDC provider instead of a real one for testing?
2. What should a mock provider's discovery document include?
3. How do you test expired token handling?
4. What is the risk of disabling signature verification in tests?
5. How can you simulate a provider outage in tests?

Answers

1. Full control over responses, no network dependency, fast feedback, and ability to simulate error cases. 2. All standard OIDC discovery fields: issuer, auth/token/userinfo/jwks endpoints, supported features. 3. Generate a token with an expiration timestamp in the past. 4. It hides bugs in your signature verification logic. 5. Configure the mock to return connection errors or timeouts.

Challenge

Build a mock OIDC provider as a Python package that supports configurable behaviors: always succeeds, always fails, simulates latency, returns specific error codes, and supports test scenarios defined in a YAML configuration file.

FAQ

Mini Project

Create a comprehensive OIDC test suite using pytest that includes: 15+ test cases covering successful login, expired tokens, wrong audience, missing nonce, invalid signature, provider errors, UserInfo failure, and concurrent login sessions. Include a test coverage report.

What's Next

• Build the complete OIDC project combining all concepts
• Review the OIDC project checklist for production readiness
• Continue to the next API topic in your learning path