SAML Browser Extenstion

[Paul Hethmon]

On Aug 23, 2016, at 12:43 PM, Reynolds, Jeffrey <JReynolds at utdallas.edu> wrote:
> 
> I’m wondering what the best practice is for SAML debugging in browser.  I see a lot of SAML browser extensions available, but I’m not sure if I’m comfortable using them considering that they could have access to sensitive data.  Is there any trusted SAML debuggers out there, or applications that anyone uses and feels comfortable using?
> 

They won’t have any greater access to the data on the wire than the browser does. If you encrypting data, then its still encrypted when you view it in the SAML debugger. I’ve had very few times when I personally needed to see the actual data values in the SAML Response for trouble shooting. It’s more about the protocol flow and whether specific attributes get released.

Paul


Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com
865.250.3517

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160823/00d286b0/attachment.html>