stboxsandbox tools
All tools

SAML 2.0 SP

Act as a Service Provider: build AuthnRequests (Redirect/POST) and consume Assertions at /saml/acs.

Identity & Auth
Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Configuration

SAML 2.0 SP — sign requests, verify assertions, decrypt encrypted responses. ACS: /saml/acs/view

Crypto

Sign/verify/decrypt use ephemeral /api/v1/saml/crypto — keys are not stored server-side. Redirect query signing is client-side.

SAML AuthnRequest Terminal
live

What is a SAML AuthnRequest?

SAML 2.0 is an XML-based SSO protocol. A Service Provider (SP) sends an AuthnRequest to an Identity Provider (IdP). After authentication, the IdP returns a SAMLResponse containing an Assertion with NameID, attributes, and Conditions.

This tool helps you craft AuthnRequests, choose Redirect or POST binding, and inspect/decrypt/verify assertions that land on the stbox ACS callback — ideal for integrating enterprise IdPs.

How to use this tool

  1. Configure SP entity ID, ACS URL, and IdP SSO URL / certificates.
  2. Generate an AuthnRequest and send it via Redirect or POST binding.
  3. After IdP login, open the ACS viewer to decrypt, verify signatures, and validate Issuer/Audience/Conditions.

Frequently asked questions

Is assertion XML stored on the server?

The ACS route bridges the SAMLResponse into sessionStorage for client-side decode. Crypto helpers may run server-assisted operations in memory without long-term logging.

Can I test encrypted assertions?

Yes. Provide the SP decryption key material and inspect plaintext AttributeStatements after decrypt.