SAML Browser Extenstion

[Brent Putman]

On 8/23/16 12:52 PM, Paul Hethmon wrote:
> On Aug 23, 2016, at 12:43 PM, Reynolds, Jeffrey
> <JReynolds at utdallas.edu <mailto:JReynolds at utdallas.edu>> wrote:
>>
>> I’m wondering what the best practice is for SAML debugging in
>> browser.  I see a lot of SAML browser extensions available, but I’m
>> not sure if I’m comfortable using them considering that they could
>> have access to sensitive data.  Is there any trusted SAML debuggers
>> out there, or applications that anyone uses and feels comfortable using?
>>
>
> They won’t have any greater access to the data on the wire than the
> browser does. If you encrypting data, then its still encrypted when
> you view it in the SAML debugger. I’ve had very few times when I
> personally needed to see the actual data values in the SAML Response
> for trouble shooting. It’s more about the protocol flow and whether
> specific attributes get released.
>

Yes, what Paul said.

I think the go-to one for a lot of people is SAML Tracer for Firefox. 
That's the one I've used for years.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160823/371a59b7/attachment.html>