SAML Decoder & Builder

SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between parties. It enables Single Sign-On (SSO) by allowing an Identity Provider (IdP) to authenticate users and pass identity information to a Service Provider (SP).

The most common version in use today is SAML 2.0, which supports:

• IdP-Initiated SSO: User starts at the IdP and is redirected to the SP
• SP-Initiated SSO: User starts at the SP, is redirected to IdP for auth, then back to SP
• Single Logout (SLO): Terminate sessions across all connected applications

SAMLRequest (AuthnRequest): Sent by the Service Provider to the Identity Provider to initiate authentication. It's typically Base64-encoded AND deflate-compressed when sent via HTTP Redirect binding.

SAMLResponse: Sent by the Identity Provider back to the Service Provider after successful authentication. Contains the SAML Assertion with user identity and attributes. Usually only Base64-encoded (not compressed) when sent via HTTP POST binding.

This tool automatically detects which type you're decoding and applies the appropriate decompression.

A SAML Assertion is the core component that carries identity information:

• Issuer: The entity that created the assertion (usually the IdP)
• Subject/NameID: The authenticated user's identifier
• Conditions: Validity constraints (NotBefore, NotOnOrAfter, AudienceRestriction)
• AuthnStatement: When and how the user authenticated
• AttributeStatement: User attributes (email, roles, groups, etc.)
• Signature: Digital signature for integrity verification

When debugging SAML integrations, watch for these common issues:

• Clock Skew: NotBefore/NotOnOrAfter validation fails due to time differences between IdP and SP
• Audience Mismatch: The SP Entity ID doesn't match the AudienceRestriction in the assertion
• Invalid Signature: Certificate mismatch or XML canonicalization issues
• Destination Mismatch: The ACS URL doesn't match the Destination attribute
• Missing Required Attributes: SP expects attributes that IdP doesn't provide