# SAML signature verifier

- Human page: https://happytails.ai/en/developer-tools/saml-signature-verifier/
- Markdown: https://happytails.ai/en/developer-tools/saml-signature-verifier.md
- Structured JSON: https://happytails.ai/agents/en/developer-tools/saml-signature-verifier/index.json
- Visibility: public

## Tool capabilities

| Property | Value |
| --- | --- |
| Tool ID | `saml-signature-verifier` |
| Category | developer-tools |
| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |
| Browser execution | Use the visible action or interactive controls. |
| Browser processing | Browser; see tool notes for network behavior. |
| HTTP API | Not callable through HTTP. |
| Browser-agent interface | run_current_tool |

### Implementation notes

Verified in your browser against the certificate you paste. Up to 1000000 characters.

### Inputs and settings

Text input: SAML response.

Example or placeholder shown in the interface (not a validated fixture):

```text
PHNhbWxwOlJlc3BvbnNlIC4uLg==
```

Paste the SAMLResponse value or the XML. Up to 1,000,000 characters. Review the settings before running.

| Setting | Meaning | Control type | Default | Constraints |
| --- | --- | --- | --- | --- |
| `certificate` | Identity provider signing certificate | textarea | "" |  |

### Browser-agent workflow

1. Open the human page in a browser that supports WebMCP.
2. Discover the interface exposed by that page; use its actual schema.
3. Select files on the page first when the tool requires files.
4. Call `run_current_tool` with valid input and settings.
5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.

Calls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.

### Planning specification

Input up to 1000000 characters, certificate up to 20000 characters, at most 20 signatures. Verification runs locally in a background worker in your browser. Download a JSON report.

This describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.

### Complete machine-readable capability record

```json
{
  "id": "saml-signature-verifier",
  "category": "developer-tools",
  "built": true,
  "requirements": "Input up to 1000000 characters, certificate up to 20000 characters, at most 20 signatures. Verification runs locally in a background worker in your browser. Download a JSON report.",
  "implementation": {
    "fields": [
      {
        "key": "certificate",
        "label": "Identity provider signing certificate",
        "value": "",
        "type": "textarea",
        "help": "PEM or Base64 X.509 certificate from the identity provider metadata."
      }
    ],
    "registrationFamily": "crypto-formats-signed-envelopes",
    "inputMaxLength": 1000000,
    "inputErrorCode": "CRYPTO_FORMATS_SIGNED_ENVELOPES_TOO_LONG_SAML",
    "note": "Verified in your browser against the certificate you paste. Up to 1000000 characters.",
    "experience": {
      "automatic": false,
      "single": false,
      "inputMaxLength": 1000000,
      "inputMode": "text",
      "label": "SAML response",
      "placeholder": "PHNhbWxwOlJlc3BvbnNlIC4uLg==",
      "help": "Paste the SAMLResponse value or the XML. Up to 1,000,000 characters. Review the settings before running.",
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}
```

## Page guide

Check the XML signatures in a SAML response in your browser against your identity provider certificate. See exactly which element each signature covers and whether the response shows signs of a signature wrapping attack.

How can we improve this tool?

Report a problem or share an idea.

Please leave out private information. Your message and the tool name go to our team via PostHog.

### How to use SAML signature verifier

1. Paste the SAMLResponse value or the XML.
2. Paste the signing certificate from your identity provider metadata.
3. Run the tool and read the verdict, the covered elements and the wrapping checks.

## Useful next steps

- [SSL checker](https://happytails.ai/en/web-tools/ssl-checker/) ([Markdown](https://happytails.ai/en/web-tools/ssl-checker.md))

- [Base64 encoder decoder](https://happytails.ai/en/developer-tools/base64-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/base64-encoder-decoder.md))

- [JWT decoder](https://happytails.ai/en/developer-tools/jwt-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/jwt-decoder.md))

## Method

Each ds:Signature is checked under W3C XML Signature 1.1: one reference to the ID of the element that contains the signature, exactly two transforms (the enveloped signature transform, then Exclusive XML Canonicalization 1.0), the digest, and the RSA or ECDSA signature over the canonical SignedInfo with SHA-256, SHA-384 or SHA-512. SHA-1, inclusive canonicalization and other transforms are refused. A reference with only the enveloped signature transform is refused too, because XML Signature then canonicalizes it inclusively.

### Wrapping defences

IDs must be unique, every signature must sit inside the element it signs, signed elements must be the Response or an Assertion directly inside it, there must be exactly one assertion, and every assertion must be covered by a valid signature. The report names the exact covered element so you can compare it with what your service provider reads.

### What it does not check

Audience, recipient, time conditions and replay are the service provider's job, and the certificate's own validity dates are only reported. Nothing is fetched; only the certificate you paste is trusted.