gosaml.dev

Test SAML without setting anything up.

Create a throwaway identity provider or service provider, point the system you are building at it, and watch every message go by. Or paste a SAML message into the inspector to see what is in it.

Test identity provider

An IdP with users you define. Register your service provider by its metadata, then log in to it as any user, with any attributes, or answer with an error to see how your SP copes. It can imitate the responses of Okta, Entra ID or Shibboleth.

Test service provider

An SP that trusts your identity provider. Log in through it to see exactly what your IdP asserts: the NameID, the attributes, the signatures, and why a Response was refused.

Inspector

Decode an AuthnRequest, Response, logout message or metadata from a URL, a POST body or base64. It runs in your browser: what you paste is not sent to the server.

Open the inspector

How it works

  1. Create an IdP or an SP. Each gets its own entity ID, endpoints and signing key.
  2. Exchange metadata with the system you are testing: give it this instance's metadata URL, and give this instance its metadata (a URL or the XML).
  3. Log in, and read the log: every request and response, decoded.

A test IdP and a test SP made here can be connected to each other in one click, to see a complete login.