Saml Decoder

SAML is an XML-based standard for exchanging authentication and authorization data between an Identity Provider (IdP) (like Okta, Entra ID) and a Service Provider (SP) (like Salesforce, KaruviLab).

It enables Enterprise Single Sign-On (SSO). Instead of creating a password for every app, employees log into the IdP once. The IdP then sends cryptographically signed SAML XML messages to the SPs, telling them "I have authenticated this user, log them in."

• SAMLRequest (AuthnRequest): Sent from the SP to the IdP, usually via a browser HTTP Redirect. It says "Please authenticate this user for me." Because it passes via URL, it is often DEFLATE compressed before Base64 encoding.
• SAMLResponse (Assertion): Sent from the IdP back to the SP, usually via an HTTP POST containing a hidden form. It contains the user's identity, attributes, and digital signatures proving it came from the IdP.

SAML relies heavily on XML Digital Signatures to prevent tampering. However, XML parsing is notoriously complex. A classic attack against SAML is XML Signature Wrapping (XSW).

In an XSW attack, a hacker intercepts the SAML Response, duplicates the Assertion, modifies the identity in the unsigned copy (e.g., changing their email to admin@company.com), and tricks the Service Provider's XML parser into verifying the signature on the original assertion but reading the identity from the fake one.

Service Providers must strictly validate the SAML Response to be secure. Common failures include:

• Ignoring the Audience Restriction: Failing to verify that the token was explicitly minted for your app (preventing token reuse across apps).
• Not checking timestamps: Failing to enforce NotBefore and NotOnOrAfter, allowing replay attacks of old tokens.
• Accepting unsigned assertions: The IdP must sign the assertion, the response, or both.