No password — this mock IdP just asserts email + roles[], exactly what real PingFed will send over OIDC.
email
roles[]