SAML Condition Time Validator
Check SAML Conditions timestamps against the current clock with configurable skew for federation debugging.
Validate SAML Conditions time window
SAML 2.0 assertions include a Conditions element with optional
NotBefore and NotOnOrAfter attributes (ISO-8601 UTC timestamps). Service
providers reject assertions that are not yet valid or already expired. Clock skew between IdP and SP
servers is normal; most stacks allow a small tolerance (often 60–180 seconds).
Paste SAML XML containing Conditions, set a skew allowance in seconds, and compare the window
against the current time. This helps debug “assertion expired” errors without changing server clocks. Related:
SAML Assertion Inspector,
JWT Claims Validator.
How skew is applied
NotBefore: valid when current time + skew is on or after NotBefore.NotOnOrAfter: valid when current time − skew is strictly before NotOnOrAfter.- Missing attributes are reported as “not set” and do not fail the other check.
Frequently Asked Questions
Which clock does the validator use?
Your browser’s current time. For reproducible checks in automated tests, use the same skew values your SP middleware documents.
Does this replace production SAML validation?
No. It is a debugging aid. Production systems must still validate signatures, audiences, and recipient endpoints per your federation profile.
Are timestamps uploaded?
No. XML stays in the browser; only the DOM parser runs locally.
Related Tools
Analyze Clock Time
SSA Triangle Calculator
Tinetti Assessment Tool
Number of Digits
Chmod Calculator
Golf Handicap Calculator
Monthly Income Calculator
Maddrey Discriminant Function Calculator
List to JSON Array
Log Reduction Calculator
Ohms Law Resistance Calculator
Webhook Retry Schedule Calculator
Transferrin Saturation Calculator
Stopwatch
CSS Switch Generator
Show HSV Image Colors
CFM Calculator
Campaign URL Builder
Volume Calculator
Fulcrum Calculator