Privacy, Limitations, and Troubleshooting

Data Privacy Commitment

ShibbDebugger states that this site never saves or sells your data.

The application processes submitted diagnostic information to perform the selected operation.

For file-based commands, XML documents are uploaded to the ShibbDebugger application server for parsing and analysis.

For URL-based commands, the server makes requests to the supplied metadata location.

This processing is distinct from selling user information.

How Information Is Processed

Operation	Processing
Metadata Parsing	XML uploaded and parsed by the server
Metadata Retrieval	Server requests specified remote URLs
Binding Inspection	Uploaded XML analyzed for binding declarations
NameID Inspection	Uploaded XML analyzed for identifier formats
Certificate Expiration	Embedded X.509 certificates parsed on the server
XML Signature Inspection	Uploaded XML inspected for signature elements
SP Configuration Lint	Uploaded configuration parsed on the server
Attribute Map Lint	Uploaded mapping XML parsed on the server
Discovery Check	Uploaded XML parsed; discovery hostname resolved
Clock Synchronization	Server queries external time providers

Local and Remote Processing

Unlike a fully client-side editor, ShibbDebugger uses a Flask backend.

Uploaded files are transmitted to the application server.

The supplied application code does not show a database or persistent file-saving operation for diagnostic uploads.

However, server infrastructure, reverse proxies, operational logging, and other deployed components are outside the supplied code.

Users should avoid submitting sensitive material unnecessarily.

External Services

Some operations contact external systems.

Service	Purpose
Metadata endpoint	Retrieve SAML XML metadata
DNS resolver	Resolve discovery service hostnames
`time.google.com`	NTP-based time reference
`timeapi.io`	HTTP-based UTC time reference
ZapCaptcha	Browser-side verification integration

These interactions support the requested functionality.

They do not, by themselves, constitute selling user data.

External services operate under their own applicable policies and operational practices.

Protecting Sensitive Configuration

Shibboleth configuration files can contain operationally sensitive information.

Before uploading a file, review whether it contains:

Passwords or shared secrets
Private keys
Internal-only hostnames
Sensitive endpoint information
Confidential attribute mappings
Organization-specific configuration details

Public SAML metadata commonly contains public certificates and endpoint information, but private configuration files may contain information that should not be disclosed.

Only submit files you are authorized to analyze.

File Upload Limit

The application configures:

MAX_CONTENT_LENGTH = 5 * 1024 * 1024

This corresponds to 5 MiB.

The browser also checks the selected file size.

Very large metadata files may exceed this limit.

File Too Large

If a file is rejected:

Check its size.
Remove unnecessary content from a test copy when appropriate.
Use an individual entity metadata document instead of a large aggregate.
Resubmit the smaller file.

Do not arbitrarily remove security-critical metadata from a document that will later be deployed.

Troubleshooting Metadata Retrieval

Metadata Not Found

The Grab Metadata command checks a limited set of known paths.

Verify that your provider exposes metadata at one of those locations.

If metadata is available at another path, supply that exact URL.

Valid Metadata Is Not Recognized

The retrieval command searches for the literal text:

<EntityDescriptor

Metadata using a namespace prefix may not satisfy that check.

Connection Timeout

The target server may be unreachable, slow, or restricted by a firewall.

Unexpected XML Output

Review the retrieved content to confirm that it is the intended metadata document.

Troubleshooting Metadata Parsing

Invalid EntityDescriptor Root

The metadata parser expects an EntityDescriptor root element in the SAML 2.0 metadata namespace.

A document using EntitiesDescriptor as its root is not accepted by that command.

Malformed XML

Check for:

Unclosed tags
Invalid characters
Incorrect nesting
Truncated content
Invalid namespace declarations

Missing Metadata Information

Some metadata fields are optional.

Missing organization or UI information does not necessarily invalidate the document.

Troubleshooting Bindings and NameID Formats

Missing Bindings

The binding checker compares observed bindings with a predefined list.

Not all listed bindings are required in every SAML integration.

Confirm actual requirements with your federation profile.

Unexpected NameID Format

The NameID checker treats formats outside its predefined list as unexpected.

Such formats may still be valid and appropriate.

No NameID Formats Found

The document may not advertise the formats the checker searches for.

Review the metadata and actual federation configuration.

Troubleshooting Certificates

Certificate Expired

The embedded X.509 certificate's expiration date has passed.

Determine whether the certificate is still in active use and follow your federation's key rollover process.

Certificate Not Found

The uploaded XML may not include certificates in the KeyDescriptor structure expected by the checker.

Certificate Parsing Failure

The embedded data may be malformed, incomplete, or unsupported by the certificate parser.

Valid Date but Authentication Still Fails

A certificate's expiration status is only one factor.

Investigate metadata trust, signature validation, key selection, federation policy, and runtime configuration.

Troubleshooting XML Signatures

No XML Signature Found

The command could not locate an XML Digital Signature element.

The document may be unsigned or use an unexpected structure.

Signature Found but Trust Still Fails

The signature checker does not perform cryptographic signature verification.

A signature's presence does not establish its validity.

Use a dedicated XML signature verification tool and the appropriate trusted key material.

Troubleshooting Service Provider Configuration

ApplicationDefaults Missing

Confirm that the uploaded file is a Shibboleth SP configuration and uses the expected XML namespace.

Sessions Missing

Review the SP's session configuration.

MetadataProvider Missing

Confirm that an appropriate metadata provider is configured for your deployment.

Attribute Map Entries Rejected

Check that each Attribute element contains the expected id and name attributes.

Decoder Type Shows None

The supplied implementation does not correctly resolve the namespace-qualified xsi:type attribute in its current form.

A None result does not automatically indicate an invalid AttributeDecoder.

Discovery URL Does Not Resolve

Verify:

Hostname spelling
DNS configuration
Network availability
Discovery URL configuration

DNS resolution alone does not establish service availability.

Troubleshooting Clock Synchronization

NTP Check Fails

The hosting server may be unable to reach the NTP reference.

HTTP Time Check Fails

The reference service may be unavailable or may return a response format that the parser cannot process.

Skew Detected

Investigate synchronization on the ShibbDebugger hosting server.

For federation authentication failures, independently check the actual SP and IdP clocks.

Security and Technical Limitations

Area	Limitation
Metadata Parsing	Requires an EntityDescriptor root
Metadata Retrieval	Searches limited paths and uses literal XML text matching
Binding Checks	Uses a fixed comparison list
NameID Checks	Uses a fixed expected-format list
Certificate Checks	Expiration inspection, not complete PKI validation
Signature Checks	Inspects XML elements without cryptographic verification
SP Config Lint	Selected structural checks only
Attribute Map Lint	Limited field checks
Discovery	URL inspection and DNS lookup, not complete service testing
Clock Skew	Checks application server, not remote SP/IdP/client clocks
File Uploads	Limited to 5 MiB
Results	Point-in-time diagnostics

Application Security Controls

The supplied backend includes:

Flask-Talisman
Secure session cookie settings
HTTP-only session cookie settings
SameSite=Lax session cookie settings
Flask-Limiter
User-agent-based crawler filtering

The source declares a rate limit of 10 requests per minute on the main routes.

Actual security behavior depends on the deployed environment.

The backend explicitly configures Flask-Talisman with Content Security Policy disabled.

The frontend includes ZapCaptcha verification, although server-side CAPTCHA validation is commented out in the supplied backend.

Responsible Usage

Use ShibbDebugger only with configuration files and endpoints you are authorized to inspect.

Before modifying production Shibboleth settings:

Back up existing configuration files.
Verify the diagnostic findings.
Consult the applicable Shibboleth documentation.
Test changes in a nonproduction environment.
Confirm end-to-end federation behavior.
Maintain rollback procedures.

Reporting Issues

When reporting a problem, include:

Selected diagnostic command
Relevant Shibboleth version
Browser information
Observed error message
Expected behavior
Minimal reproducible XML, when appropriate

Remove secrets, private keys, credentials, and confidential organizational information from examples.

Final Reminder

ShibbDebugger is designed to simplify Shibboleth and SAML troubleshooting by providing accessible diagnostic checks.

A successful diagnostic result is not a guarantee of secure or interoperable federation behavior.

Always verify critical findings using the appropriate Shibboleth tools, trusted federation metadata, and production-relevant testing.