Test WS-Federation (Mock RP)

⚠ This tool makes real HTTP redirects to an IdP-STS. The reply URL (wreply) must be reachable from the browser after IdP authentication (i.e. this server must be publicly accessible for non-local IdP-STS).

IdP-STS Federation Metadata

Paste WS-Fed Federation Metadata XML (or upload below)

Don't have metadata? Enter the sign-in endpoint URL and (optionally) signing cert manually below instead.

Sign-In Endpoint URL (PassiveRequestorEndpoint — where wsignin1.0 requests are sent)

Signing Certificate PEM (manual)

Metadata is parsed automatically as you paste or type it — the button below is only needed to re-parse manually or see an error message.

RP Configuration

wtrealm (RP Identifier) *

wreply (Reply URL) * (auto-populated)

RP Signing Key Pair (optional — not required by the spec)

Not required by the WS-Fed passive profile itself (there's no request body to sign — parameters are plain query string), but some IdP-STS implementations want an RP certificate published in RP metadata for token encryption or additional trust checks.

Certificate (PEM) — goes into RP metadata

RP Metadata

Sign-In Request Parameters (wsignin1.0)

Sensible defaults are already filled in below (expand "Advanced" to review or edit them). Click "Build Request Parameters" when ready.

Advanced sign-in parameters (wctx, wct, wfresh, whr, wp, wencoding, wreq, wreqptr, extra query params)

Correlation token (wctx) ?

Opaque context, echoed back verbatim by the IdP. Used here to correlate the response back to this session (like SAML RelayState). Auto-filled with the session ID — clear it or change it to test correlation-failure handling.

Request timestamp (wct)

Force fresh login (wfresh) ?

Minutes; 0 forces fresh re-authentication (no SSO). Leave blank to omit.

Home realm hint (whr)

Policy reference (wp)

wencoding

wreq (raw RST XML, optional)

wreqptr (URL pointer to RST, optional)

Extra Query Parameters (optional)

Send Request to IdP-STS

Open IdP-STS request in this window instead of a new window

Default opens a separate window. Use same-window mode when you want DevTools to stay attached to the sign-in redirect.

Sign Out (optional)

RP-initiated sign-out sends wa=wsignout1.0 to the IdP-STS. IdP-initiated cleanup (wa=wsignoutcleanup1.0) is normally called silently by the IdP via a hidden iframe on each RP it's signing you out of — this tool logs any hit to its stateless cleanup endpoint below.

Post-logout wreply (optional)

wsignoutcleanup1.0 hits received

No hits yet