How do we test SSO before launch?
You can run the entire SSO flow end to end without your institution's real identity provider, using the built-in test IdP (FakeU).
What FakeU is
FakeU is a small OpenID Connect provider built into First Six for exactly this
purpose. It implements the real endpoints (authorize, token, jwks) and
mints valid tokens against demo personas, so the callback, identity linking, and
session minting all run through the genuine code path. Nothing is stubbed.
How to use it
- Point sso_config at FakeU
Set the institution's
sso_configissuer to the FakeU endpoint and the client id to the test client. - Start the normal sign-in
Begin sign-in as usual. Instead of a real login screen, you're redirected to a persona picker.
- Pick a persona
Choose a student or staff persona scoped to the tenant.
- Watch the real flow run
The callback verifies the token, links the identity to the persona's record, and sets a session, exactly as production would.
Because it exercises claim_sso_identity for real, it also validates that your
roster is in place, which is the most common pre-launch snag.
FakeU is disabled in production unless it is explicitly enabled, and it requires its signing key to be configured. It is a pre-launch and staging tool, not something that can be left reachable on a live tenant.
When to switch to the real IdP
Once the flow works against FakeU and your roster syncs cleanly, swap sso_config
to your real IdP (for example Microsoft Entra) and run the same test with a real
account. If the roster is right, the only thing that changes is where the login
screen comes from.
Common questions
Our test login fails with 'no record to link'. Why?
The roster isn't in place. SSO links to an existing student or staff record; run SIS sync first so the persona's email resolves to a row.
Can we leave FakeU on for a pilot?
No. It's gated off in production by default and should stay that way; use it on staging or pre-launch only.
Does FakeU prove our real IdP will work?
It proves the First Six side (callback, linking, session). The last step is always a real sign-in against your IdP to confirm the issuer, client id, and email claim line up.
Related
The fastest answer is usually one question away.