No account

Analyse a SAML response

Paste a response received by your application (or the value of the SAMLResponse field). ID-Kit verifies it as a serious application would and explains each problem.

ID-Kit analyses the response as an application would: signature, recipient, audience, validity… Nothing is saved, and no account is needed.

The SAML response

The raw XML, the base64 value of the SAMLResponse field, or the full form body (SAMLResponse=…).

What the application expects (for more thorough checks)

Application identifier (Entity ID / Audience)

The application's unique name, often an address (it does not need to be reachable). It must be identical, character for character, to the one the application uses ("Audience" field). A trailing slash or http instead of https is enough to block everything.

Receiving address (ACS URL)

The exact address of the application that receives the SAML response. The IdP sends the person back there after login. It is in the application's metadata, under the name "AssertionConsumerService".

Expected IdP identifier (Issuer)

The unique name of the IdP (also called Issuer). The application checks that the response really comes from this issuer. Copy it from the IdP's metadata.

Request ID (expected InResponseTo)

The checks a serious application must perform on a SAML response, in order: status, signature, recipient, audience, validity… Open a check to see what was found and how to fix it.

IdP signing certificate (PEM or base64)

The IdP's certificate. Its public key lets you verify that the response was really signed by the IdP and not modified. When the IdP renews its certificate, you must update it here, otherwise all logins fail.