Demo environment. Penrose Analytics is fictional, the demo people are shared, and the workspace resets nightly.

Gatehouse

Flow inspector

Each SAML sign-in this browser starts is recorded here: the signed request, the signed response decoded, every check Gatehouse ran, and the session that came out. Select a message to open it. Only this browser can see its own flow.

Start a SAML sign-in

Nothing recorded yet

Start a sign-in and you'll land back here with the whole exchange. This is what one looks like:

  4. signature verified ✓Checked against the certificate this connection trusts.
    binding
    HTTP-POST
    inResponseTo
    _b7a2c41e
    <samlp:Response ID="_3f9c05d1" InResponseTo="_b7a2c41e" Destination="https://auth.example/api/saml/acs">
    <saml:Issuer>https://idp.penrose.example/metadata</saml:Issuer>
    <ds:Signature>
    <ds:SignedInfo>
    <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
    <ds:Reference URI="#_3f9c05d1">
    <ds:DigestValue>Qm9ndXMgZGlnZXN0IHZhbHVl…</ds:DigestValue>
    </ds:Reference>
    </ds:SignedInfo>
    <ds:SignatureValue>c2lnbmF0dXJlIGJ5dGVzLCBzaG9ydGVuZWQ…</ds:SignatureValue>
    </ds:Signature>
    <samlp:Status>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </samlp:Status>
    <saml:Assertion ID="_91e0aa7c">
    <saml:Subject>
    <saml:NameID>maya.okafor@penrose.example</saml:NameID>
    </saml:Subject>
    <saml:AttributeStatement>
    <saml:Attribute Name="groups">
    <saml:AttributeValue>penrose-staff</saml:AttributeValue>
    </saml:Attribute>
    </saml:AttributeStatement>
    </saml:Assertion>
    </samlp:Response>