SAML 2.0 SP

Act as a Service Provider: build AuthnRequests (Redirect/POST), inflate/deflate Redirect bindings, and consume Assertions at /saml/acs.

Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Configuration

SAML 2.0 SP — sign requests, verify assertions, decrypt encrypted responses. ACS: /saml/acs/view

Service provider & IdP

Core trust endpoints used to build and validate the SAML exchange.

SAML Metadata

Import IdP metadata (Okta, Entra ID, Ping, Shibboleth) or export / temporarily host SP metadata for IdP registration.

Import IdP metadata

Export SP metadata

Built from your SP Entity ID, ACS URL, NameID format, and optional SP certificate. Private keys are never included.

Request options

Binding, subject identifier format, and optional state.

Crypto & trust

Signing, assertion verification, and encrypted assertion handling.

Key & certificate materialShow

Sign/verify/decrypt use ephemeral /api/v1/saml/crypto — keys are not stored server-side. Redirect query signing is client-side.

SAML AuthnRequest Terminal
live

What is a SAML AuthnRequest?

SAML 2.0 is an XML-based SSO protocol. A Service Provider (SP) sends an AuthnRequest to an Identity Provider (IdP). After authentication, the IdP returns a SAMLResponse containing an Assertion with NameID, attributes, and Conditions.

This tool helps you craft AuthnRequests, choose Redirect or POST binding, and inspect/decrypt/verify assertions that land on the Utilxo ACS callback — ideal for integrating enterprise IdPs.

How to use this tool

  1. Import IdP metadata (XML file or metadata URL) to auto-fill Entity ID, SSO endpoints, and signing certificate — or configure SP entity ID, ACS URL, and IdP values manually.
  2. Generate SP metadata XML to download or host temporarily for IdP registration, then send an AuthnRequest via Redirect or POST binding.
  3. Use Deflate Utility to inflate Redirect SAMLRequest URLs or deflate XML for HTTP-Redirect debugging.
  4. After IdP login, open the ACS viewer to decrypt, verify signatures, and validate Issuer/Audience/Conditions.

Frequently asked questions

Is assertion XML stored on the server?

The ACS route bridges the SAMLResponse into sessionStorage for client-side decode. Crypto helpers may run server-assisted operations in memory without long-term logging.

Can I test encrypted assertions?

Yes. Provide the SP decryption key material and inspect plaintext AttributeStatements after decrypt.

How do I use IdP / SP metadata?

Paste or fetch IdP EntityDescriptor XML to populate SSO URL and signing cert. Generate SP metadata from your ACS/entity settings, then download it or host a temporary URL (60 minutes) for portals that require a live metadata endpoint. Private keys are never included in hosted SP metadata.