Free SAML test bench
ID-Kit plays the role you are missing. It shows you what happens at each step, and when it fails, it explains why and how to fix it.
You are developing or configuring an application and want to check that it accepts SAML logins. ID-Kit plays the identity provider.
You are configuring Entra ID, Okta, Keycloak… and want to check what it sends. ID-Kit plays the application.