SAML never got a conformance suite. Until now.
An open-source, black-box test suite for SAML identity providers and service providers, evaluated against the Kantara Implementation Profile.
OIDC and OAuth have the OpenID Foundation's Conformance Suite, so a product can reproducibly demonstrate that it conforms to a profile. SAML has no widely recognized equivalent, even though the materials for assessing implementation quality have been public for years. SAMLscope translates the Kantara SAML V2.0 Implementation Profile for Federation Interoperability into executable tests, so anyone can verify a SAML implementation under the same conditions.
Real endpoints, not admin APIs
SAMLscope drives standard SAML and metadata endpoints and records redacted Transcripts. It never uses vendor administration APIs as conformance evidence.
- Browser SSOForceAuthn, IsPassive, NameIDPolicy, ACS selection, and proxy processing.
- Single Logout & ECPFront-channel and back-channel SLO, Enhanced Client or Proxy, channel binding, SAML Enhanced Client extensions.
- MetadataAcquisition, trust, refresh, key rollover, MDQ, discovery, and algorithm declarations.
- Signatures & encryptionVerification of supported algorithms and compliance with algorithm declarations.
Three plans, one cumulative ladder
The plans differ only in evidence depth. One action can provide evidence to multiple cases, and the UI reports both case coverage and the remaining deliberate actions.
Follow the login, consent, logout, or continue prompts yourself. SAMLscope evaluates the SAML, metadata, browser result, and Transcript it observes along the way.
Make the configuration or metadata-refresh change SAMLscope requests. It determines the outcome from what happens next, no self-report needed.
Supply grouped evidence only for the behavior standard external interfaces cannot establish on their own.
One action can provide evidence to multiple cases. Each plan is cumulative, not a separate track: Standard includes everything Quick covers, Full includes everything Standard covers.
The design gates are signed. The suite runs.
External-observation coverage and reference-implementation acceptance testing continue to improve. Capabilities that cannot be observed stay explicit as SELF_ATTESTED or NOT_VERIFIED, never guessed.