A mock server written in Go that generates signed JWT tokens for simulating Google Cloud Confidential Space authentication.
The tee-mock-server is a Golang-based project designed to simulate a server that generates JWT tokens,
specifically tailored for Google Cloud's Confidential Space.
It listens on a Unix domain socket and responds with a newly signed JWT that includes custom claims related
to Confidential Space.
The server uses an RSA private key to sign the token and handles graceful shutdown with automatic cleanup of the socket file on termination.
This mock server is useful for testing and simulating token-based authentication workflows in Confidential Space environments.
- JWT Token Generation: The server generates signed JWT tokens using a predefined RSA private key, including custom claims related to Google Cloud Confidential Space.
- Unix Domain Socket: It listens for incoming requests on a Unix domain socket, providing a simple and efficient way to interact with the server, with automatic cleanup of the socket file upon termination.
Before starting the mock server, you must make sure that the /run/container_launcher folder exists and you have the
right to write in it:
sudo mkdir /run/container_launcher
sudo chmod -R 777 /run/container_launcher To install this project using Docker, you can simply run the following command:
docker compose upYou can easily generate a new token using the following cURL command:
sudo curl -s -N --unix-socket /run/container_launcher/teeserver.sock --data '{ "audience": "foobar", "token_type": "PKI" }' http://localhost/v1/tokenThe TEE Mock Server allows some level of configuration so that the token it generates can vary depending on your needs. Here's a list of the different environment variables that can be set when starting the server:
| Name | Default | Description |
|---|---|---|
TEE_GOOGLE_SERVICE_ACCOUNT |
tee-mock-server@localhost.gserviceaccount.com | The GCP SA that is set in the "google_service_accounts" claims of the generated token |
TEE_TOKEN_EXPIRATION_IN_MINUTES |
5 | The token expiration time in minutes |
This project is distributed under the Apache License 2.0, making it open and free for anyone to use and contribute to. See the license file for detailed terms.