Test WS-Federation (Mock RP)

⚠ This tool makes real HTTP redirects to an IdP-STS. The reply URL (wreply) must be reachable from the browser after IdP authentication (i.e. this server must be publicly accessible for non-local IdP-STS).

IdP-STS Federation Metadata

Paste WS-Fed Federation Metadata XML (or upload below)

Don't have metadata? Enter the sign-in endpoint URL and (optionally) signing cert manually below instead.

Sign-In Endpoint URL (PassiveRequestorEndpoint — where wsignin1.0 requests are sent)

Signing Certificate PEM (manual)

RP Configuration

wtrealm (RP Identifier) *

wreply (Reply URL) * (auto-populated)

RP Signing Key Pair (optional) ?

Not required by the WS-Fed passive profile itself (there's no request body to sign — parameters are plain query string), but some IdP-STS implementations want an RP certificate published in RP metadata for token encryption or additional trust checks.

Certificate (PEM) — goes into RP metadata

RP Metadata

Sign-In Request Parameters (wsignin1.0)

All parameters below are editable before sending — clear or tamper with any of them to test negative/edge cases.

wctx ?

Opaque context, echoed back verbatim by the IdP. Used here to correlate the response back to this session (like SAML RelayState). Auto-filled with the session ID — clear it or change it to test correlation-failure handling.

wct (request timestamp)

wfresh ?

Minutes; 0 forces fresh re-authentication (no SSO). Leave blank to omit.

whr (home realm hint)

wp (policy)

Advanced: wencoding, wreq, wreqptr, extra query params

wencoding

wreq (raw RST XML, optional)

wreqptr (URL pointer to RST, optional)

Extra Query Parameters (optional)

Send Request to IdP-STS

Open IdP-STS request in this window instead of a new window

Default opens a separate window. Use same-window mode when you want DevTools to stay attached to the sign-in redirect.

Sign Out

RP-initiated sign-out sends wa=wsignout1.0 to the IdP-STS. IdP-initiated cleanup (wa=wsignoutcleanup1.0) is normally called silently by the IdP via a hidden iframe on each RP it's signing you out of — this tool logs any hit to its stateless cleanup endpoint below.

Post-logout wreply (optional)

wsignoutcleanup1.0 hits received

No hits yet