mPass QA

QA · test data only

Everything running on the QA environment, in one place. The dot on each card is live: green means the service is answering, red means it is not.

Platform

Admin console
Operators and tenant admins: users, factors, policies, channels, approvals.
admin.qa.mpass.samPass sign-in
Self-service portal
End users: enrol and manage factors, change or reset a password, see their apps.
my.qa.mpass.samPass sign-in
SSO · Keycloak
The sign-in every app here uses. Its admin console is blocked on QA.
sso.qa.mpass.sa

Channel simulators

Where the codes go: QA sends no real email, SMS or push.
Mailpit
Every email the engine sends: OTP codes, enrolment and reset links.
mail.qa.mpass.satester password
Phone simulator
A stand-in phone: SMS inbox, push approvals, Nafath, and QR activation of the app.
appsim.qa.mpass.satester password
PEP demo
A relying party that calls the engine's runtime API directly to step a user up.
pep.qa.mpass.satester password

SSO test apps

Each one signs you in through mPass, so you can see what an integrated app receives.
Mock Oracle EBS
OIDC relying party showing the signed-in user and the acr / amr assurance claims.
ebs.qa.mpass.saOIDC
OIDC debugger
Runs an authorization-code flow and shows the raw ID, access and refresh tokens.
oidc.qa.mpass.saOIDC
oauth2-proxy
A reverse proxy guarding an app with no login of its own; shows the headers it passes on.
proxy.qa.mpass.saOIDC
SAML SP (passport-saml)
A Node.js service provider: signs in over SAML 2.0 and shows the assertion's attributes.
saml.qa.mpass.saSAML
SimpleSAMLphp SP
A PHP service provider, the common reference for SAML interoperability.
sp.qa.mpass.saSAML

Behind the scenes

MFA engine Keycloak Admin portal backend Self-service backend Provider simulator

Before you test

Getting in

  • There are no shared test users. Ask an operator to create your account.
  • tester password tools share one login, user mpass. Ask the team for the password; never post it in a ticket.

Factors

Authenticator app (TOTP), passkeys, pattern grid, email, SMS, push, Nafath and split code. Email codes land in Mailpit; SMS, push and Nafath in the phone simulator.

Data

QA is for testing only and can be reset without notice. Never enter real personal data, real phone numbers or a password you use anywhere else.