SAML Response and Request Decoder

How to decode a SAML message

1. Paste what you have. All of these work:
   • the bare SAMLResponse or SAMLRequest value, URL-encoded or not
   • SAMLRequest=… with or without RelayState, SigAlg and Signature
   • a whole Redirect URL copied from the address bar
   • the HTML auto-submit form with the hidden SAMLResponse input
   • raw XML
2. The decoder detects the binding: plain Base64 means HTTP-POST, deflated data means HTTP-Redirect.
3. Read the summary first, then the pretty-printed XML below it. The XML is shown as text and never rendered.

The Encode direction does the reverse: paste an AuthnRequest and get a Redirect value, a SAMLRequest= parameter or a full URL built from the Destination attribute. That is handy for replaying a request while testing a service provider.

Redirect binding vs POST binding

Redirect uses compression because URLs have practical length limits. In the example used on this page, a 464-character AuthnRequest deflates to 273 bytes and travels as 364 Base64 characters. Responses carry signatures and certificates, so they are too big for a URL and go through POST. The decoder also accepts zlib-wrapped data, which some service providers send on Redirect instead of raw deflate.

What to check when SSO fails

The summary pulls out the fields that cause most login failures:

• Status: anything other than urn:oasis:names:tc:SAML:2.0:status:Success. A sub-code such as AuthnFailed, InvalidNameIDPolicy or RequestDenied names the reason, and StatusMessage often adds detail.
• Destination and ACS URL: must match the endpoint configured at the service provider exactly, including https and a trailing slash.
• Audience: must equal the SP entity ID. A mismatch here is a common misconfiguration after renaming an application.
• Conditions: NotBefore and NotOnOrAfter are checked against your clock. “Expired” or “not valid yet” on a fresh login points to clock skew between the IdP and SP.
• InResponseTo: should equal the ID of the AuthnRequest. A mismatch suggests a stale or replayed response. The attribute is absent in IdP-initiated logins, which some service providers reject.
• NameID and Format: the identifier the SP will match against its users, for example emailAddress versus persistent.
• Attributes: every attribute with all its values, to confirm the IdP sends the groups or email the SP maps.

Decoding SAML in Python

import base64, zlib
from urllib.parse import unquote

def decode_post(value):
    return base64.b64decode(value).decode()

def decode_redirect(value):
    raw = base64.b64decode(unquote(value))
    return zlib.decompress(raw, -15).decode()

The -15 tells zlib to expect raw deflate without a header. Call unquote only on values you copied from a URL; a value from a POST form is already plain Base64, and URL-decoding it can turn + into a space. More in Base64 in Python, and the compression side is explained on the raw deflate and zlib page.

Privacy of SAML assertions

An assertion holds names, email addresses, group memberships and sometimes more personal data, and a valid unexpired one can be a login token. This page decodes it locally and cannot send it anywhere. Still, redact assertions before pasting them into tickets or chats, and treat a captured response like a session cookie until its NotOnOrAfter has passed.

FAQ