SAML Signature Reference Inspector

Read XML Signature details inside SAML messages

SAML responses and assertions often carry an enveloped ds:Signature block defined by XML Signature Syntax and Processing. Integration failures frequently trace back to mismatched canonicalization, unexpected transform chains, or wrong digest algorithms, not to the human-readable assertion body.

Paste signed SAML XML to list each signature’s canonicalization and signature methods, every Reference URI with its transforms and digest metadata, and a short preview of the embedded X509Certificate. This complements the SAML Response Decoder and SAML Assertion Inspector when you already have decoded XML.

What to compare with your SP configuration

• Reference URI, should point at the signed element’s ID (for example #_assertion-id).
• Transforms, enveloped signature plus exclusive C14N is typical for SAML 2.0 assertions.
• Digest and signature algorithms, SHA-256 family is common; legacy SHA-1 may still appear on older IdPs.
• Certificate material, compare the embedded cert with metadata from your IdP federation.