{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

{{ badge.label }} {{ badge.value }}
Optional context for copied and exported review artifacts.
Choose the metadata shape the receiving SAML product expects.
No endpoint is contacted; the policy classifies declared Binding and Location evidence.
Paste XML or load one local XML/TXT file, up to 200,000 characters.
{{ sourceStatus }}
Use the planned import or review date, interpreted as UTC.
days
A 30–90 day lead time is common for coordinated rollover.
days
This is an acceptance horizon, not an OASIS-mandated fixed duration.
{{ requireSignatureBool ? 'Signature element required' : 'Presence observed only' }}
The neutral default records presence without requiring it; aggregate profile still requires a signature element.
{{ requireDefaultAcsBool ? 'Default marker required' : 'Index evidence accepted' }}
The neutral default accepts a single ACS or explicit index selection without requiring isDefault=true.
The neutral default accepts the validator's full bounded limit of 100 entities.
AreaStatusEvidenceRecommended actionCopy
{{ row.area }}{{ row.status }}{{ row.evidence }}{{ row.action }}
EntityRoleProtocolEndpointsKeysRefresh windowCopy
{{ row.entity }}{{ row.role }}{{ row.protocol }}{{ row.endpoints }}{{ row.keys }}{{ row.refresh }}
EntityRoleServiceBindingLocationStatusCopy
{{ row.entity }}{{ row.role }}{{ row.service }}{{ row.binding }}{{ row.url }}{{ row.status }}
EntityRole/useValid untilDays leftSHA-256 fingerprintStatusCopy
{{ row.entity }}{{ row.role_use }}{{ row.valid_until }}{{ row.days_left }}{{ row.fingerprint }}{{ row.status }}
No embedded X.509 certificate rows were found.

The chart renderer is unavailable. The readiness score and control matrix remain available.

SAML Assertion Timing Checker Check SAML assertion timing from XML or encoded captures, apply clock-skew and expiry rules, and separate bearer from replay and session evidence.
SSL Certificate Chain Checker Check a live TLS host or pasted PEM chain for broken issuer links, hostname and expiry problems, then build a root-aware install bundle.
JWT Claims Risk Checker Check JWT headers and claims against issuer, audience, time, algorithm, replay, exposure, and token-profile rules without uploading the token.
OAuth Redirect URI Policy Checker Compare OAuth redirect URI registrations with observed requests to find exact-match drift, unsafe schemes and wildcard or nested-redirect risk.

Security Assertion Markup Language (SAML) metadata is the configuration contract that lets identity providers and service providers recognize one another. It names each entity, declares its SAML role, lists protocol endpoints and bindings, publishes key material, and may set refresh or expiry bounds. An import can fail even when the XML is well formed because the expected role, endpoint, or signing certificate is missing.

A service provider (SP) consumes assertions and normally publishes at least one Assertion Consumer Service (ACS) endpoint. An identity provider (IdP) authenticates users and publishes Single Sign-On Service endpoints plus signing key material. Federation aggregates can contain many entities and usually need tighter signature, uniqueness, size, and refresh controls than a one-partner exchange.

Entity identifier
A stable entityID that partners use to distinguish one SAML entity from another. It is an identifier, not necessarily a page that a browser should open.
Binding
The transport profile for a service, such as HTTP-POST or HTTP-Redirect.
Location
The absolute URL where the declared service is available. Production exchange normally expects HTTPS.
Key descriptor
Published X.509 certificate material used for signing or encryption according to the role and partner policy.

Certificate dates and metadata validity answer different questions. An embedded certificate may expire while the surrounding metadata is still current, or metadata may need refreshing while its certificate remains valid for years. Rollover planning therefore needs both the certificate's validity period and the metadata's validUntil or refresh policy.

Signature presence is also different from signature trust. Finding a Signature element can satisfy a policy that requires signed metadata to be present, but only cryptographic verification against an approved trust anchor can prove that the signature is valid and covers the intended content.

An import-readiness review is a preflight check. It can expose malformed structure, role mismatches, endpoint policy problems, expired material, and missing declarations before partner exchange. It cannot prove that the remote service is reachable, that keys are trusted, or that an end-to-end login will succeed.

How to Use This Tool:

Choose the receiving system's expected metadata shape before pasting XML. A valid IdP document can still be wrong for an SP-metadata import profile.

  1. Select the Review profile for service provider, identity provider, federation aggregate, or automatic inventory.
  2. Choose an Endpoint policy that matches production, strict signed exchange, or lab use. The policy classifies declared URLs; it does not contact them.
  3. Paste or load the current SAML metadata XML, then set the UTC Evaluation date for the planned import or review.
  4. Set the certificate warning horizon, maximum accepted metadata validity, signature requirement, default ACS policy, and intended entity cap.
  5. Read the verdict and Metadata Control Matrix first. Resolve every Blocker before partner import and inspect each Review finding against the receiving product's policy.
  6. Compare the role, endpoint, and certificate ledgers with the partner handoff, then verify signatures and connectivity in the actual SAML stack.

Interpreting Results:

Import blockers means at least one required structural or policy condition failed. Review needed means no blockers were found, but an endpoint, certificate, validity window, entity count, protocol declaration, or optional policy still needs judgment. Import-ready snapshot means every evaluated finding passed for the selected inputs.

Do not use the percentage by itself. A single blocker lowers the score by 25 points, but the blocker name tells you what prevents import. After a clean snapshot, verify XML signatures with the consumer, test endpoint reachability, confirm trusted fingerprints, and complete an actual SAML login flow.

Technical Details:

The document must have one XML root and remain within 200,000 characters, 5,000 elements, and 64 levels of nesting. The accepted SAML metadata roots are EntityDescriptor and EntitiesDescriptor in the SAML 2.0 metadata namespace. Entity identifiers must be present, unique within the file, contain no whitespace, and be no longer than 1,024 characters.

Rule Core

The selected profile determines which role evidence is required, while the endpoint policy controls how declared locations are classified.

AreaPass evidenceImportant blocker or review condition
RoleThe requested SP or IdP descriptor is present, or inventory mode finds a supported role.No supported role or a profile mismatch blocks.
SP servicesAt least one ACS endpoint exists.Missing ACS blocks; multiple ACS endpoints without a required default marker need review.
IdP servicesAt least one SSO endpoint and one signing or unspecified X.509 candidate exist.Missing SSO or signing key material blocks.
Binding and LocationBinding is from the common SAML 2.0 set and Location is a usable absolute HTTPS URL.Missing values or a non-absolute URL block; unknown bindings and non-HTTPS locations are classified by the selected policy.
CertificateDER, not-before, and not-after values parse and include the evaluation date.Unreadable, not-yet-valid, or expired material blocks; expiry on or inside the warning horizon needs review.
Metadata validityvalidUntil is later than the evaluation date and within the selected maximum horizon.Expired or unreadable values block; missing or overlong validity needs review.
Signature presenceA Signature element exists when explicitly required or when reviewing an aggregate.Missing required presence blocks; detected presence never proves cryptographic validity.

Known endpoint bindings include HTTP-POST, HTTP-Redirect, HTTP-Artifact, SOAP, and PAOS. Under strict HTTPS, any non-HTTPS location blocks. The production policy marks non-HTTPS locations for review, while the lab policy permits local-host testing more leniently. Missing Binding or Location always blocks.

Formula Core

The readiness percentage is an operator heuristic. Each Blocker subtracts 25 points and each Review subtracts 8 points; the result is clamped to the inclusive range 0 to 100.

S=max(0, min(100,100-25B-8R))

B is the blocker count and R is the review count. The verdict uses counts directly: any blocker yields Import blockers; otherwise any review yields Review needed; only zero blockers and zero reviews yields Import-ready snapshot.

Certificate inspection decodes the embedded X.509 data, reads validity times, and calculates a SHA-256 fingerprint. It does not build a trust chain, check revocation, evaluate certificate purpose, or validate the XML signature. Those checks belong in the receiving SAML product or a dedicated signature-validation workflow.

Limitations and Privacy Notes:

The XML is parsed locally and no declared endpoint is contacted. Metadata is often public, but it can still reveal internal hostnames, partner identifiers, certificate rollover timing, and topology that should not be placed in public tickets without review.

  • Signature presence is not cryptographic signature verification.
  • Certificate dates and fingerprints do not establish trust, revocation status, or correct signing use.
  • Endpoint syntax and policy do not prove DNS resolution, TLS trust, reachability, or successful SAML messages.
  • The readiness penalties, warning horizon, validity horizon, and entity cap are selected review policies rather than fixed OASIS requirements.

Worked Examples:

An IdP document without a signing key

An IdP descriptor can have the correct namespace, entity identifier, SAML 2.0 protocol declaration, HTTPS Single Sign-On Service, and valid refresh window yet still be unfit for import. If it publishes no signing or unspecified X.509 candidate, that missing key is one Blocker. The readiness score becomes 75, but the actionable conclusion is Import blockers until the IdP publishes appropriate key material.

References: