A self-contained SAML 2.0 Identity Provider for development and testing purposes. Designed to be used with a hardcoded list of users to simulate SAML authentication.

• Single Binary: All HTML and CSS is embedded - no external files needed at runtime
• Multiple Service Providers: Configure multiple SPs, each with their own users and settings
• Simple Configuration: Single YAML config file for all settings
• Custom User Attributes: Define arbitrary attributes for each test user
• No Passwords Required: Simple dropdown UI to select a predefined user
• IDP Metadata Endpoint: Automatic metadata generation at /metadata

make generate-certs

This creates self-signed certificates in the certs/ directory.

Copy the example configuration:

cp config.example.yaml config.yaml

Edit config.yaml to add your service providers and test users.

make build
make run

Or run directly:

./bin/saml-test-idp -config config.yaml

The IDP will start on http://localhost:8080 by default.

Usage: saml-test-idp [options]

Options:
  -config string
        Path to YAML configuration file (default "config.yaml")
  -version
        Show version and exit

All configuration is done via the YAML config file. See config.example.yaml for a fully documented example.

server:
  host: "localhost"
  port: 8080
  base_url: "http://localhost:8080"

idp:
  entity_id: "http://localhost:8080/metadata"
  certificate_path: "certs/idp.crt"
  private_key_path: "certs/idp.key"

service_providers:
  - entity_id: "https://myapp.example.com/saml/metadata"
    acs_url: "https://myapp.example.com/saml/acs"
    name_id_format: "email"  # email, persistent, transient, unspecified
    users:
      - name: "Alice Admin"
        name_id: "alice@example.com"
        attributes:
          email: "alice@example.com"
          firstName: "Alice"
          lastName: "Admin"
          groups:
            - "admins"
            - "users"
          role: "admin"
      
      - name: "Bob User"
        name_id: "bob@example.com"
        attributes:
          email: "bob@example.com"
          firstName: "Bob"
          lastName: "User"
          groups:
            - "users"
          role: "member"

Note: Relative file paths (like certs/idp.crt) are resolved relative to the config file's directory, not the current working directory.

Point your application's SAML configuration to:

http://localhost:8080/metadata

Add your application to config.yaml:

service_providers:
  - entity_id: "your-app-entity-id"
    acs_url: "https://your-app.com/saml/callback"
    name_id_format: "email"
    users:
      - name: "Test User"
        name_id: "test@example.com"
        attributes:
          email: "test@example.com"

1. Initiate SAML login from your application
2. You'll be redirected to the IDP login page
3. Select a user from the dropdown
4. Click "Sign In"
5. You'll be redirected back to your application with the SAML response

• Go 1.25 or later
• Make (optional, for convenience)

# Build the binary
make build

# Run tests
make test

# Run with test coverage
make test-coverage

# Format code
make fmt

# Clean build artifacts
make clean

MIT License