SAML Lab · Entra ID
Home
Metadata
Checking a box
disables
that security check — the SP becomes vulnerable in that dimension.
Signature Verification
Bypass IdP XML signature check — enables XML Signature Wrapping (XSW) attacks
Timing Validation
Ignore NotBefore / NotOnOrAfter conditions — allows replayed or expired assertions
Audience Restriction
Skip audience check — assertions intended for another SP will be accepted
Unsigned Assertions
Accept assertion elements that carry no Signature child
Apply