Capture and View a SAML Request and Response

Owned by Chris deRito
Last updated: Jun 30, 2022 by Christopher R. Perry
3 min read

Problem

You need to view the SAML Request and SAML Response for a SAML SSO attempt in order to troubleshoot an issue.

Solution

Utilize Fiddler to capture the HTTP traffic containing the SAML Request and Response, then use the Fiddler Text Wizard to decode them.

  1. Follow the steps in the following article to Install and configure Fiddler to capture HTTPS traffic.

    1. KB:https://bio-key.atlassian.net/l/c/VgiAzsNf

  2. Start a fiddler capture via one of the following methods:

    1. Pressing F12 within Fiddler

    2. Clicking the blank space in the bottom left corner of the Fiddler window

    3. Toggling on File → Capture Traffic

  3. Complete either of the following SAML SSO flows:

    1. IdP-Initiated SSO by going first to the PortalGuard SSO Jump Page and clicking on the correct application tile.

    2. SP-Initiated SSO by going to the Service Provider site to be redirected to PortalGuard for sign-in.

  4. Once SSO is complete (success or failure), stop the Fiddler capture with the same process outlined in step 2.

  5. Navigate back to Fiddler. On the left hand side, look for the entry that would contain the SAML Request or SAML Response.

    1. For IdP-Initiated SAML, the SAML Request will be in the entry for the ‘/sso/go.ashx’ endpoint and the SAML Response will typically be in the next entry with the service providers domain.

       

    2. For SP-Initated SAML, the SAML Request and Response will be in the same locations, just spread out more to account for the steps in between.

       

  6. Once you locate the entry with the SAML Request and/or SAML Response, on the right hand side click on the tab “Inspectors” and then the sub-tab “WebForms”.

  7. Right Click on the Value to the right of the SAML Request or SAML Response, and select “Send to TextWizard…”

  8. In the window that appears, click the dropdown next to “Transform:” and select “From DeflatedSAML”.

  9. The textbox in the bottom of this window will contain your decoded message. You can then copy and paste this into any text editor such as Notepad++ to view it.

    1. NOTE: Notepad++ has an plugin called XMLTools that allows you to easily format the XML data so it is easily readable. There are also many online tools that do this such as https://xmlpretty.com