OAuth2 & OpenID Connect Debugger — SAML Assertion Tool

Compose, sign (XML Signature), and encrypt (XML Encryption) a SAML assertion — fully spec compliant with SAML 1.0, 1.1, or 2.0. Choose which optional elements the assertion carries, set the NameID, and add custom attributes; the identifier and every instant are populated with the current time. All crypto runs in your browser with the same XML security primitives the SAML Test Tools page uses. No key material leaves this page except into your browser's local storage, and the generated keys are throwaway test keys. Controls that do not apply to the selected assertion version, or to an option you have not enabled, are hidden.

1. Compose Assertion

Generated Assertion

Compliance Output

Assertion

Assertion Version

Issuer

Assertion ID

Timestamps

Validity (minutes)

Clock skew (seconds)

IssueInstant

NotBefore

NotOnOrAfter

Subject / NameID

<Subject> (SAML 2.0 assertion level)

NameID value

NameID Format

NameQualifier

SPNameQualifier

Confirmation Method

Recipient

InResponseTo

Confirmation NotOnOrAfter

Address

Optional Elements

<Conditions> (validity window)

Audience

OneTimeUse condition

Proxy Count

<Advice> (AssertionIDRef)

Advice AssertionIDRef

AuthnInstant

AuthnContextClassRef

AuthenticationMethod

SessionIndex

SessionNotOnOrAfter

Locality Address

Locality DNS Name

Authz Resource

Decision

Action

Action Namespace

Add Custom SAML Attribute

Add custom attributes (<AttributeStatement>)

Type

URI Prefix

Name	URI Prefix	Type	Value
No custom attributes.

2. Sign (XML Signature)

An enveloped XML-DSIG over the assertion: the Reference covers the whole assertion with the enveloped-signature and canonicalization transforms, and the <ds:Signature> is placed where the selected version's schema requires it.

Signature Algorithm

Canonicalization

Key Size

Private Signer Key

Public Signer Certificate

View certificate details →

Signed Assertion

Validate a Signature

Signed XML to Verify

Verification Certificate

Verification Output

3. Encrypt (XML Encryption)

W3C XML Encryption of the assertion with a random session key, which is itself RSA-wrapped with the recipient certificate. Encryption is always applied after the digital signature (sign-then-encrypt). SAML 2.0 carries the result in <saml:EncryptedAssertion>; SAML 1.x has no such element, so the bare <xenc:EncryptedData> is produced.

Recipient Key Size

Encryption Certificate

Recipient Private Key

View certificate details →

Encrypted Type (transformation)

Canonicalization

Data Encryption Algorithm

Key Transport Algorithm

Key Transport Digest (OAEP)

MGF (RSA-OAEP xmlenc11)

Wrap in <saml:EncryptedAssertion>

Assertion to Encrypt

Encrypted Assertion

Decrypt an EncryptedAssertion

EncryptedAssertion to Decrypt

Decryption Output