Drive a WS-Federation Passive Requestor Profile sign-in against an Identity Provider (e.g. AD FS / Azure AD). Load the IdP FederationMetadata.xml, set the relying-party realm (wtrealm) and return URL (wreply), then send the browser to the IdP with wa=wsignin1.0. The IdP POSTs a wresult (a WS-Trust RequestSecurityTokenResponse carrying a SAML assertion) back to wreply; it is shown on the WS-Federation Response page, where you can validate the token signature and decrypt an encrypted token. The passive-profile sign-in request itself is not signed.
This is the static (backend-less) deployment. There is no API proxy, so metadata must be pasted in (a direct browser fetch is usually blocked by CORS) and the backend routing option is disabled below. There is also no landing endpoint, and the IdP returns the token as an HTTP POST, so the response cannot be captured automatically: build the sign-in request here, complete it in the browser, then paste the returned wresult into the WS-Federation Response page to inspect it. The token is captured, though: the IdP's POST to wreply is answered at the CDN edge by a function that hands the wresult to the WS-Federation Response page, so the full round trip completes here with no server. (The passive profile has no redirect response binding, so unlike SAML there is no other way to do this statically.)
Tip: click a pane's title to collapse/expand it.
