SAML Metadata Retrieval and Parsing

Understanding SAML Metadata

SAML metadata is an XML document describing an identity or service provider.

It can contain:

Entity identifiers
Supported protocols
Service endpoint URLs
SAML bindings
Signing and encryption certificates
Organization information
Contact information
User interface information

A common SAML metadata root element is:

<md:EntityDescriptor
  xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
  entityID="https://idp.example.org/idp/shibboleth">
</md:EntityDescriptor>

Grab Metadata from URL

The Grab Metadata command attempts to retrieve an XML metadata document from a remote location.

How to Use

Select Grab Metadata from URL.
Enter a metadata URL or server base URL.
Click Execute Command.
Review the retrieved XML.

Example Input

https://idp.example.org

Paths Checked

ShibbDebugger attempts the following locations sequentially:

Order	Path
1	Supplied URL
2	`/idp/metadata`
3	`/idp/shibboleth`

For the example host, these become:

https://idp.example.org
https://idp.example.org/idp/metadata
https://idp.example.org/idp/shibboleth

Each request uses a six-second timeout.

The command stops when it receives a successful HTTP response containing the literal text <EntityDescriptor.

Metadata Result

When metadata is found, ShibbDebugger displays:

The URL from which metadata was retrieved
A text editor containing the XML
An Edit button
A Download button

Editing Retrieved Metadata

Click Edit to make the XML text editable in the result window.

This allows you to adjust the retrieved content before downloading it.

Editing in this interface does not modify the remote identity provider's configuration.

Downloading Metadata

Click Download to save the XML document locally.

The filename is:

metadata.xml

The downloaded content reflects the editor's current value.

Retrieval Limitations

The implementation uses a simple text check rather than full XML validation during retrieval.

It looks for:

<EntityDescriptor

Documents using a namespace-prefixed opening tag such as <md:EntityDescriptor> may not be recognized even when they contain valid SAML metadata.

The command also does not search every possible federation metadata endpoint.

Parse Metadata File

The Parse Metadata command extracts selected information from an uploaded SAML metadata document.

How to Use

Select Parse Metadata File.
Upload an XML metadata file.
Click Execute Command.
Review the extracted information.

Expected Root Element

The parser expects an EntityDescriptor root in the SAML 2.0 metadata namespace.

Example:

<EntityDescriptor
  xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
  entityID="https://idp.example.org/idp/shibboleth">
</EntityDescriptor>

Documents with an EntitiesDescriptor root are not accepted by this specific parser, even though such documents are supported by the SAML metadata standard.

Extracted Fields

Field	Description
EntityID	Identifier of the metadata entity
SAML Version	Value derived from the IdP protocol support declaration
Display Name	User-facing name from metadata UI information
Information URL	Additional information URL
Privacy Statement URL	Privacy information URL
Logo URL	Image URL from metadata UI information
Organization	Organization name
Organization URL	Organization website
Contacts	Available contact names and email addresses
Binding	SAML protocol binding identifiers
Location	Endpoint addresses
Certificates	Embedded X.509 certificate material

Entity Identifier

The entityID attribute uniquely identifies a federation participant within its trust context.

Example:

https://idp.example.org/idp/shibboleth

An entity identifier may resemble a URL without necessarily serving as an accessible website.

User Interface Information

The parser looks for the SAML Metadata UI extension.

Fields include:

DisplayName
InformationURL
PrivacyStatementURL
Logo

These fields may help users identify the organization or service during authentication.

Organization Information

The parser extracts selected organization information, including organization name and URL.

Contact Information

The parser examines ContactPerson elements and reports available names and email addresses.

For example:

Contact (technical): Administrator [email protected]

SAML Endpoints

ShibbDebugger iterates through XML elements and reports attributes named:

Binding
Location

These identify protocol transport bindings and associated service locations.

Embedded Certificates

The parser extracts X.509 certificate material from KeyDescriptor elements.

For each certificate, it attempts to parse the PEM representation.

The metadata parser outputs the certificate's Base64 text when successfully parsed.

For expiration details, use the separate Check Certificate Expiration command.

Example Report

Result of: ParseMetadataCommand

EntityID: https://idp.example.org/idp/shibboleth

Display Name: Example Identity Provider
Organization: Example University
Organization URL: https://example.org

Binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
Location: https://idp.example.org/idp/profile/SAML2/Redirect/SSO

The values above are illustrative.

Common Errors

Invalid Metadata Root

The uploaded document does not have the expected EntityDescriptor root element and namespace.

XML Parsing Failure

The XML may contain malformed markup or invalid syntax.

Missing Fields

Some metadata elements are optional.

The absence of display names, contacts, or organization information does not necessarily mean the metadata is invalid.

Recommended Workflow

Retrieve the metadata or obtain it from the federation administrator.
Parse the document.
Review entity identifiers and endpoints.
Inspect advertised bindings and NameID formats.
Check certificate expiration.
Examine signature-related information.
Verify trust and compatibility in the actual Shibboleth deployment.

Important: Metadata parsing extracts information; it does not establish that the metadata is trusted, cryptographically valid, or accepted by a federation.