Portable system for testing SAML 2 systems

[Brent Putman]

> Therefore, I’m looking at SAML debugging tools which I can use to 
> isolate problems that may arise, like SAMLTEST.ID 
> <https://samltest.id/>. However, I cannot use SAMLTEST.ID 
> <https://samltest.id/> itself, as my site is in our Intranet, and 
> only accessible to clients on site or connected via a VPN.
>
>

Unless you are doing back-channel (and you almost certainly are not), 
the SP does not need to be reachable by the IdP directly, nor vice 
versa.  They don't communicate directly, messages are passed 
front-channel via the user's browser.  As long as the user sitting at 
the browser can reach both, then that's fine.  In other words, as long 
as a user sitting on your intranet or VPN can reach both your internal 
SP and SAMLTEST.ID on the internet, that works.  However, if your 
intranet or VPN restricts traffic outbound to the internet from the 
users' computers, then yeah, that would be a problem.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210520/80c53498/attachment.htm>