About gosaml.dev

gosaml.dev is a set of SAML 2.0 testing tools built on github.com/crewjam/saml, a SAML implementation in Go. The test IdPs and SPs use the library's x/samlidp and x/samlsp packages, with their default, hardened checks, so they behave as an application built on it would.

Everything is temporary

Test IdPs and SPs, their keys, users and logs are deleted 24h after they are created. The server keeps them in a database that is deleted whenever it restarts, which may be at any time. Nothing is backed up.

Who can see what

• The management page of an instance is reachable by anyone who has its URL, and by no one else. Keep it to yourself.
• Metadata and protocol endpoints are public, as SAML needs them to be.
• The log of an instance holds the messages it exchanged, including the attributes of users who logged in through it. Do not log in with real accounts or personal data.
• Sessions at the test IdPs and SPs are kept in the same temporary database, with a cookie in your browser, for single sign-on and single logout.
• The inspector decodes messages in your browser with WebAssembly. What you paste is not sent anywhere. If an IdP posts a Response to the inspector page itself, that request reaches the server, which puts it in the page and keeps nothing.

Limits

An IdP can have 50 users and 50 service providers. Metadata is fetched only from public addresses, with a size limit. The test IdPs do not resolve AuthnRequests sent by artifact (their metadata does not offer it); Responses by artifact, and single logout through the browser or over SOAP, are supported.