Never Let Okta or Entra ID Cert Rollovers
Break Production SSO.

Free mock IdPs only test happy-path logins. SAML Chaos Lab acts as an adversarial Identity Provider, injecting dual-key rollovers, XML signature wrapping (XSW), expired assertions, and replay attacks directly into your Service Provider ACS before Fortune 500 enterprise rollouts.

LOCAL_CLI_RUNNER [READY]

$ docker compose up --build && pnpm smoke

Get Pro License ($89/mo) Explore 33 Fault Scenarios →

[✔] Dual-Key Overlap Verifier

[✔] XSW 1–8 Defense Suite

[✔] Assertion Replay Shield

[✔] Signed Audit JSON Proof

SAML 2.0 FAULT-INJECTION CONSOLE

ACS: https://staging.app.io/saml/acs

SELECT_FAULT_INJECTION_VECTOR MUTATION_ACTIVE: 01

SAML-CERT-001 // CERT_ROLLOVER_OVERLAP

HIGH AVAILABILITY RISK

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_resp_9a8f" Version="2.0">
  <saml:Issuer>https://idp.okta-mock.local/sso</saml:Issuer>
  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:KeyInfo>
      <!-- MUTATION: Injected Secondary Rollover Cert #2 (Overlap Period) -->
      <ds:X509Certificate>MIIDqDCCApCgAwIBAgIGAX29bQz8...[ROTATED_SECONDARY_KEY]</ds:X509Certificate>
    </ds:KeyInfo>
    <ds:SignatureValue>f7bE2wKq...[VALID_RSA_SHA256_WITH_SECONDARY_KEY]</ds:SignatureValue>
  </ds:Signature>
  <saml:Assertion ID="_assert_c71e">
    <saml:Subject><saml:NameID>admin@enterprise.corp</saml:NameID></saml:Subject>
  </saml:Assertion>
</samlp:Response>

SECURE SP EXPECTATION PASS (200 OK)

SP keystore caches multiple signing keys; verifies assertion via rotated secondary cert without dropped sessions.

COMMON PRODUCTION DEFECT 500 OUTAGE

SP only stores the primary cert in config. Valid rotation triggers 'Signature verification failed' — company-wide SSO lockout.

ALG: RSA-SHA256

DIGEST: SHA-256

KEY_ID: KEY-SEC-2026-B

CLOCK_DRIFT: 0.00s (NOMINAL)

The Annual Cert Rollover Trap & Production SSO Blindspots

Standard staging environments only test happy-path logins with a static mock certificate. In enterprise production, identity providers like Okta, Microsoft Entra ID, and Ping Identity regularly roll signing keys or experience clock drift.

FAULT-VEC: CERT-01 SEV-1 OUTAGE

The Dual-Key Rollover Lockout

When an enterprise admin schedules a certificate rotation, Okta publishes a new certificate alongside the existing one. If your Service Provider code only binds to a single static string in an environment variable, every single user is locked out the millisecond the IdP switches the signing key.

Scenario: SAML-CERT-001 [Automated in Lab]

FAULT-VEC: REPLAY-04 PENTEST FINDING

Stateless Assertion Replay

SAML 2.0 assertions are valid for a temporal window (typically 5 minutes). If your ACS endpoint fails to index consumed Assertion IDs in a distributed TTL cache (such as Redis), an attacker or intercepted browser token can replay the exact same response and authenticate repeatedly.

Scenario: SAML-REPLAY-001 [Automated in Lab]

FAULT-VEC: XSW-03 CVSS 9.8 EXPLOIT

XML Signature Wrapping (XSW)

Naive XML parsing libraries verify the digital signature against one node in the XML DOM tree, but extract user attributes (like `admin: true` or `email`) from a different node. SAML Chaos Lab injects all 8 XSW variants to prove your parser is strictly anchored.

Scenario: SAML-XSW-001..008 [Automated in Lab]

SAML 2.0 Negative Fault Matrix

18 hostile test vectors covering every critical failure mode outlined in OASIS SAML 2.0 specifications and enterprise vendor security audits.

SUITE_COVERAGE: 100% AUTOMATED

Fault Code	Failure Injection Vector	Target Domain	Expected SP Verdict	Enterprise Severity
SAML-CERT-001	Dual-Key Overlap Secondary Cert Acceptance	Key Lifecycle	ACCEPT (HTTP 200)	CRITICAL AVAILABILITY
SAML-CERT-002	Expired Signing Certificate in Metadata	Key Lifecycle	REJECT (HTTP 401)	HIGH SECURITY
SAML-CERT-003	Unrecognized / Self-Signed Rogue IdP Certificate	Trust Boundary	REJECT (HTTP 401)	CRITICAL SPOOFING
SAML-XSW-001	XSW-1: Cloned Root Assertion with Detached Signature	XML Integrity	REJECT (HTTP 401)	CVSS 9.8 EXPLOIT
SAML-XSW-003	XSW-3: Extensions Wrapper with Forged Assertion Root	XML Integrity	REJECT (HTTP 401)	CVSS 9.8 EXPLOIT
SAML-TIME-001	Assertion Exceeds NotOnOrAfter (-300s Expired)	Temporal Validity	REJECT (HTTP 401)	HIGH BOUNDARY
SAML-TIME-002	Excessive Clock Skew Tolerance Test (+180s in Future)	Temporal Validity	REJECT (HTTP 401)	MEDIUM SKEW
SAML-REPLAY-001	Duplicate Consumed Assertion ID Re-transmission	Replay Defense	REJECT (HTTP 400)	HIGH PENTEST RISK
SAML-AUD-001	Mismatched Audience Restriction URI Injection	Audience Scope	REJECT (HTTP 403)	HIGH INTEGRITY

+ 15 additional negative scenarios including canonicalization and signature stripping View License Packages →

Pass Enterprise Vendor Reviews With Signed Audit Proof

Enterprise procurement teams from Fortune 500 banks, healthcare networks, and defense contractors will not take your word that SSO works. They demand verified evidence of certificate rollover tolerance, clock boundary limits, and signature wrapping immunity.

[01]

Automated Continuous Smoke Runs Inject faults directly into your staging CI/CD pipeline via Docker or headless CLI runner before pull requests merge.

[02]

SOC 2 & ISO 27001 Cryptographic Attestation Generate a machine-readable JSON artifact signed by our audit engine to satisfy auditor negative-testing controls.

[03]

Zero Production Lockout Guarantee Prove that your SP smoothly survives Okta and Entra ID dual-key rollover periods with 0% downtime.

ATTESTATION REPORT ARTIFACT

HASH: sha256:7f8a9...c4b

TARGET_ENTITY_ID: https://auth.acme-corp.com/saml/metadata

READINESS_INDEX: 96 / 100 (ENTERPRISE GRADE)

DUAL_KEY_ROLLOVER: VERIFIED (DUAL CACHE PASSED)

XSW_IMMUNITY: 8/8 EXPLOITS MITIGATED

REPLAY_CACHE_TTL: 300s REDIS STORE ENFORCED

Artifact: ./artifacts/saml-readiness-audit.json Get Pro License →

Tactile Lab Packages & CI Licenses

Run 6 baseline checks locally for free, unlock all 33 CVE scenarios for your next release, or automate full SAML conformance in CI/CD.

DEVELOPER TIER

Community CLI Lab

Run the mock IdP and 6 baseline protocol-hygiene checks locally on your workstation.

$0 / Free Forever

✔ 6 baseline protocol checks
✔ CLI + Docker in-process runner
✔ Local SP smoke test scripts
✔ Locked preview of 27 Pro CVE checks

Download Free CLI

ONE-TIME SPRINT

14-Day Release Pass

For engineering teams closing enterprise deals or running a pre-release audit.

$179 / 14-day pass

✔ All 33 CVE & negative scenarios
✔ XSW 1–8 & XML smuggling vectors
✔ SHA-256 tamper-evident SARIF & HTML reports
✔ Single target host verification
✔ Instant offline Ed25519 key delivery

RECOMMENDED FOR CI/CD

CONTINUOUS DEPLOYMENT

Pro CI/CD License

Automate SAML negative testing inside GitHub Actions and CI pipelines.

$89 / month (or $790/yr)

✔ Unlimited CI & PR test gate runs
✔ All 33 Catalog 2.0.0 scenarios
✔ Up to 2 target host SPs
✔ SARIF, JSON, and HTML reports
✔ 14-day money-back guarantee

Never Let Okta or Entra ID Cert Rollovers Break Production SSO.