Overview

A local, MSAL-compatible emulator of Microsoft Entra ID (Azure AD) in a single Go binary: the OIDC/OAuth 2.0 v2.0 endpoints MSAL talks to, SAML 2.0 and WS-Federation, passkeys, a stateful Microsoft Graph, SCIM 2.0 in both directions, and an unauthenticated admin REST API. Develop sign-in, token acquisition and protected-API calls offline, with no cloud tenant.

Caution

Local development tool only, and intentionally insecure: open admin API, publicly known seeded users and secrets, self-signed TLS, unencrypted signing key. Run it on localhost only.

Start here

• Quick start — a token out of a local binary in a few minutes
• Installation — Docker, Homebrew, winget, binaries, source
• Architecture — how the pieces fit together
• Configuration — environment and origins
• Data model and seed — the fixed GUIDs CI fixtures rely on

The protocol surface

• OIDC endpoints — discovery, authorize, token, device code
• Token service — claim shapes, signing, JWKS
• Graph API and SCIM provisioning
• Admin REST API — the portal’s control surface

How the claims are checked

• Parity map — every claim, and the witness that proves it
• E2E SDK matrix — which real client drives which flow
• Roadmap — what is delivered, and what is deliberately out of scope