diff --git a/internal/mocks/mockupstreamoidcidentityprovider/generate.go b/internal/mocks/mockupstreamoidcidentityprovider/generate.go
new file mode 100644
index 00000000..cb9c46df
--- /dev/null
+++ b/internal/mocks/mockupstreamoidcidentityprovider/generate.go
@@ -0,0 +1,6 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package mockupstreamoidcidentityprovider
+
+//go:generate go run -v github.com/golang/mock/mockgen  -destination=mockupstreamoidcidentityprovider.go -package=mockupstreamoidcidentityprovider -copyright_file=../../../hack/header.txt go.pinniped.dev/internal/oidc/provider UpstreamOIDCIdentityProviderI
diff --git a/internal/mocks/mockupstreamoidcidentityprovider/mockupstreamoidcidentityprovider.go b/internal/mocks/mockupstreamoidcidentityprovider/mockupstreamoidcidentityprovider.go
new file mode 100644
index 00000000..e3887b82
--- /dev/null
+++ b/internal/mocks/mockupstreamoidcidentityprovider/mockupstreamoidcidentityprovider.go
@@ -0,0 +1,159 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+
+// Code generated by MockGen. DO NOT EDIT.
+// Source: go.pinniped.dev/internal/oidc/provider (interfaces: UpstreamOIDCIdentityProviderI)
+
+// Package mockupstreamoidcidentityprovider is a generated GoMock package.
+package mockupstreamoidcidentityprovider
+
+import (
+	context "context"
+	gomock "github.com/golang/mock/gomock"
+	nonce "go.pinniped.dev/pkg/oidcclient/nonce"
+	oidctypes "go.pinniped.dev/pkg/oidcclient/oidctypes"
+	pkce "go.pinniped.dev/pkg/oidcclient/pkce"
+	oauth2 "golang.org/x/oauth2"
+	url "net/url"
+	reflect "reflect"
+)
+
+// MockUpstreamOIDCIdentityProviderI is a mock of UpstreamOIDCIdentityProviderI interface
+type MockUpstreamOIDCIdentityProviderI struct {
+	ctrl     *gomock.Controller
+	recorder *MockUpstreamOIDCIdentityProviderIMockRecorder
+}
+
+// MockUpstreamOIDCIdentityProviderIMockRecorder is the mock recorder for MockUpstreamOIDCIdentityProviderI
+type MockUpstreamOIDCIdentityProviderIMockRecorder struct {
+	mock *MockUpstreamOIDCIdentityProviderI
+}
+
+// NewMockUpstreamOIDCIdentityProviderI creates a new mock instance
+func NewMockUpstreamOIDCIdentityProviderI(ctrl *gomock.Controller) *MockUpstreamOIDCIdentityProviderI {
+	mock := &MockUpstreamOIDCIdentityProviderI{ctrl: ctrl}
+	mock.recorder = &MockUpstreamOIDCIdentityProviderIMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use
+func (m *MockUpstreamOIDCIdentityProviderI) EXPECT() *MockUpstreamOIDCIdentityProviderIMockRecorder {
+	return m.recorder
+}
+
+// ExchangeAuthcodeAndValidateTokens mocks base method
+func (m *MockUpstreamOIDCIdentityProviderI) ExchangeAuthcodeAndValidateTokens(arg0 context.Context, arg1 string, arg2 pkce.Code, arg3 nonce.Nonce) (oidctypes.Token, map[string]interface{}, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ExchangeAuthcodeAndValidateTokens", arg0, arg1, arg2, arg3)
+	ret0, _ := ret[0].(oidctypes.Token)
+	ret1, _ := ret[1].(map[string]interface{})
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// ExchangeAuthcodeAndValidateTokens indicates an expected call of ExchangeAuthcodeAndValidateTokens
+func (mr *MockUpstreamOIDCIdentityProviderIMockRecorder) ExchangeAuthcodeAndValidateTokens(arg0, arg1, arg2, arg3 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ExchangeAuthcodeAndValidateTokens", reflect.TypeOf((*MockUpstreamOIDCIdentityProviderI)(nil).ExchangeAuthcodeAndValidateTokens), arg0, arg1, arg2, arg3)
+}
+
+// GetAuthorizationURL mocks base method
+func (m *MockUpstreamOIDCIdentityProviderI) GetAuthorizationURL() *url.URL {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAuthorizationURL")
+	ret0, _ := ret[0].(*url.URL)
+	return ret0
+}
+
+// GetAuthorizationURL indicates an expected call of GetAuthorizationURL
+func (mr *MockUpstreamOIDCIdentityProviderIMockRecorder) GetAuthorizationURL() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAuthorizationURL", reflect.TypeOf((*MockUpstreamOIDCIdentityProviderI)(nil).GetAuthorizationURL))
+}
+
+// GetClientID mocks base method
+func (m *MockUpstreamOIDCIdentityProviderI) GetClientID() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetClientID")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// GetClientID indicates an expected call of GetClientID
+func (mr *MockUpstreamOIDCIdentityProviderIMockRecorder) GetClientID() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClientID", reflect.TypeOf((*MockUpstreamOIDCIdentityProviderI)(nil).GetClientID))
+}
+
+// GetGroupsClaim mocks base method
+func (m *MockUpstreamOIDCIdentityProviderI) GetGroupsClaim() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetGroupsClaim")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// GetGroupsClaim indicates an expected call of GetGroupsClaim
+func (mr *MockUpstreamOIDCIdentityProviderIMockRecorder) GetGroupsClaim() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGroupsClaim", reflect.TypeOf((*MockUpstreamOIDCIdentityProviderI)(nil).GetGroupsClaim))
+}
+
+// GetName mocks base method
+func (m *MockUpstreamOIDCIdentityProviderI) GetName() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetName")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// GetName indicates an expected call of GetName
+func (mr *MockUpstreamOIDCIdentityProviderIMockRecorder) GetName() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetName", reflect.TypeOf((*MockUpstreamOIDCIdentityProviderI)(nil).GetName))
+}
+
+// GetScopes mocks base method
+func (m *MockUpstreamOIDCIdentityProviderI) GetScopes() []string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetScopes")
+	ret0, _ := ret[0].([]string)
+	return ret0
+}
+
+// GetScopes indicates an expected call of GetScopes
+func (mr *MockUpstreamOIDCIdentityProviderIMockRecorder) GetScopes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetScopes", reflect.TypeOf((*MockUpstreamOIDCIdentityProviderI)(nil).GetScopes))
+}
+
+// GetUsernameClaim mocks base method
+func (m *MockUpstreamOIDCIdentityProviderI) GetUsernameClaim() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetUsernameClaim")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// GetUsernameClaim indicates an expected call of GetUsernameClaim
+func (mr *MockUpstreamOIDCIdentityProviderIMockRecorder) GetUsernameClaim() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUsernameClaim", reflect.TypeOf((*MockUpstreamOIDCIdentityProviderI)(nil).GetUsernameClaim))
+}
+
+// ValidateToken mocks base method
+func (m *MockUpstreamOIDCIdentityProviderI) ValidateToken(arg0 context.Context, arg1 *oauth2.Token, arg2 nonce.Nonce) (oidctypes.Token, map[string]interface{}, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ValidateToken", arg0, arg1, arg2)
+	ret0, _ := ret[0].(oidctypes.Token)
+	ret1, _ := ret[1].(map[string]interface{})
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// ValidateToken indicates an expected call of ValidateToken
+func (mr *MockUpstreamOIDCIdentityProviderIMockRecorder) ValidateToken(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ValidateToken", reflect.TypeOf((*MockUpstreamOIDCIdentityProviderI)(nil).ValidateToken), arg0, arg1, arg2)
+}