SAML Assertion and Signature Validator

Review SAML structure, correlation, audiences, recipients, and time windows without claiming XML-signature trust.

Signature presence is reported separately from cryptographic verification. A passing structural review is not authorization or proof of deployment acceptance.

SAML Response / AssertionXML · structural review

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" InResponseTo="_req_1001" Destination="https://app.example.test/saml/acs"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.example.test</saml:Issuer><saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Conditions NotBefore="2026-01-01T00:00:00Z" NotOnOrAfter="2099-01-01T00:00:00Z"><saml:AudienceRestriction><saml:Audience>https://app.example.test</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Subject><saml:SubjectConfirmation><saml:SubjectConfirmationData Recipient="https://app.example.test/saml/acs" InResponseTo="_req_1001" /></saml:SubjectConfirmation></saml:Subject></saml:Assertion></samlp:Response>

Expected issuer

Expected audience

Expected recipient

Expected InResponseTo

warningsaml.signature_missing · $.signature · No XML Signature element was supplied.

StatusReviewable

AssertionPresent

Signaturemissing

Findings1

Validation reviewStructural evidence only

{
  "status": "reviewable",
  "summary": {
    "root": "samlp:Response",
    "issuer": "https://idp.example.test",
    "audience": "https://app.example.test",
    "recipient": "https://app.example.test/saml/acs",
    "destination": "https://app.example.test/saml/acs",
    "inResponseTo": "_req_1001",
    "assertionPresent": true,
    "signature": "missing",
    "timeWindow": {
      "notBefore": "2026-01-01T00:00:00Z",
      "notOnOrAfter": "2099-01-01T00:00:00Z"
    }
  },
  "issues": [
    {
      "code": "saml.signature_missing",
      "level": "warning",
      "path": "$.signature",
      "message": "No XML Signature element was supplied."
    }
  ]
}