ShibbDebugger

Core Capabilities

Category	Diagnostic Tools
Service Provider	Configuration linting, attribute map linting, XML discovery checks
Identity Provider & Metadata	Metadata retrieval, metadata parsing, SAML binding inspection, NameID format checks
Certificates & Signatures	Certificate expiration analysis, XML signature inspection
Time Synchronization	Clock skew checks against external time sources

Available Commands

ShibbDebugger includes 10 diagnostic commands.

Command	Purpose	Input
Lint Configuration File	Inspect Shibboleth SP configuration structure	XML file
Lint Attribute Map File	Inspect attribute mapping entries	XML file
Check XML Discovery	Inspect discovery service settings	XML file
Grab Metadata from URL	Retrieve SAML metadata from known endpoints	URL
Parse Metadata File	Extract SAML metadata details	XML file
Check SAML Bindings	Identify supported SAML protocol bindings	XML file
Check NameID Formats	Inspect advertised identifier formats	XML file
Check Certificate Expiration	Inspect embedded X.509 certificate expiration dates	XML file
Check XML Signature	Inspect XML signature elements and algorithm identifiers	XML file
Check For Client Clock Skew	Compare application server time with external UTC sources	None

Service Provider Diagnostics

ShibbDebugger can inspect configuration files commonly associated with Shibboleth Service Provider deployments.

Supported checks include:

Required configuration block presence
Session and SSO configuration elements
Discovery service URL configuration
Attribute mapping structure
Metadata provider declarations

These checks can help identify missing or incorrectly structured elements.

Identity Provider and SAML Metadata Diagnostics

The metadata tools inspect SAML XML documents and report information such as:

Entity identifiers
Protocol declarations
Display names
Organization information
Technical contacts
SAML service endpoints
Protocol bindings
NameID formats
X.509 certificates

Certificate Diagnostics

ShibbDebugger examines embedded X.509 certificates and reports their expiration dates.

The tool can identify certificates that have passed their notAfter date and calculate remaining days for certificates that have not expired.

XML Signature Inspection

The signature tool identifies XML Digital Signature elements and reports available signature and digest algorithm identifiers.

Important: The supplied implementation does not perform cryptographic verification of the XML signature. It inspects signature-related XML elements.

Clock Synchronization

ShibbDebugger compares the application server's UTC clock against external NTP and HTTP time services.

Clock synchronization is relevant to SAML because assertions commonly include time-based validity conditions.

Browser-Based Interface

The application provides:

A diagnostic command selector
Context-sensitive URL and file inputs
A single Execute Command action
Results displayed on a separate page
CAPTCHA integration in the browser interface

Uploaded files are processed through the application's Flask backend.

File Upload Limit

The configured maximum request content length is:

5 MiB (5,242,880 bytes).

The browser also checks selected file size before submission.

Privacy

ShibbDebugger displays the following commitment:

This site never saves or sells your data.

The submitted backend processes uploaded XML files and requested diagnostic inputs. Metadata retrieval and time checks can involve external network requests.

The supplied code does not show database persistence of uploaded diagnostic content. However, the complete hosting and logging configuration is outside the provided source.

Intended Audience

ShibbDebugger is particularly useful for:

Identity and access management administrators
Shibboleth deployment engineers
SAML federation operators
University and institutional IT teams
Security engineers
Developers troubleshooting federated authentication

Documentation Guide

Getting Started
SAML Metadata Retrieval and Parsing
SAML Bindings and NameID Formats
Certificates and XML Signatures
Service Provider Configuration Diagnostics
Clock Synchronization
Privacy, Limitations, and Troubleshooting

Important: ShibbDebugger provides diagnostic observations and configuration checks. A successful result does not guarantee that a SAML federation is interoperable, secure, or correctly configured end to end.