SAML Metadata Parser

SAML Metadata Parser turns an EntityDescriptor or a federation EntitiesDescriptor into a readable summary. For each entity you see its roles (identity provider, service provider, attribute authority, authentication authority, policy decision point), every endpoint with its binding name and canonical URI, index and default flag, the NameID formats, published and requested attributes, organization, contacts, extensions, validUntil and cacheDuration.

Every certificate in a KeyDescriptor is decoded with the same engine as the X.509 Certificate Inspector: intended use (signing, encryption or both), subject, issuer, serial number, validity window, days until expiry, SHA-256 fingerprint and key algorithm with size or curve. Copy PEM hands a certificate to other tools. Several signing certificates are reported as a key rollover, not as an error.

Findings are graded Invalid, Warning or Info. Invalid means partners will likely fail to use the metadata: an IdP without a SingleSignOnService, an SP without an AssertionConsumerService, duplicate endpoint indexes, an expired validUntil or an expired certificate. Warnings cover plain HTTP endpoints, several default endpoints, certificates that expire within 30 days and missing signing certificates. A warning does not make the metadata invalid.

Metadata signatures are reported by presence and algorithm only; they are not cryptographically verified. DOCTYPE and ENTITY declarations are rejected. Inputs up to 5 MB and 50,000 XML elements are accepted, and up to 2,000 distinct certificates are inspected. Nothing is fetched from metadata URLs. Parsing runs entirely in your browser: metadata and contact details are not uploaded, stored, logged or added to the URL.