What Phase 1 actually covers.

SAMLscope's current scope is the Kantara SAML V2.0 Implementation Profile for Federation Interoperability v1.1, decomposed obligation by obligation, not requirement by requirement.

Functional profiles

Choose the function and role you want to verify

Each profile is a versioned set of existing approved cases. Cases keep their original obligations, conditions, variants and controls; choosing a profile does not create a second kind of test. Exact membership is independently approved and installed through release-pinned definitions.

IdPWeb Browser SSOAuthentication request handling and Response/Assertion generation.View case mapping →SPWeb Browser SSOAuthentication Response/Assertion reception and validation.View case mapping →IdPMetadataIdP metadata publication and SP metadata consumption.View case mapping →SPMetadataSP metadata publication and IdP metadata consumption.View case mapping →IdPSingle LogoutLogout messages, correlation and session handling.View case mapping →SPSingle LogoutLogout messages, correlation and session handling.View case mapping →IdPEnhanced Client or Proxy (ECP)ECP authentication and associated protocol processing.View case mapping →

What's tested

One requirement can decompose into several obligations, each independently testable and independently scored.

  • Protocols & bindingsWeb Browser SSO, Single Logout, and Enhanced Client or Proxy, over HTTP-Redirect, HTTP-POST, and SOAP back-channel.
  • Messages & assertionsRequests, responses, assertions, identifiers, ForceAuthn, IsPassive, NameIDPolicy, ACS selection, and proxy processing.
  • MetadataAcquisition, trust, scheduled refresh, key rollover, MDQ, discovery, and algorithm declarations.
  • Signatures & encryptionSupported algorithm verification and compliance with algorithm declarations in metadata.
Roadmap

Phase 1 of 5

Later phases reuse the Phase 1 Test Runner foundation and work backward from attacker capabilities rather than adding new infrastructure.

Current1Implementation ConformanceKantara IIP v1.1
2Core ConformanceOASIS SAML Core / Bindings / Profiles
3Deployment & InteroperabilityKantara Deployment Profile v2.0
4Security & Attacker ModelOASIS Security & Privacy Considerations
5Fuzzing & Differential TestingSAMLscope-original scope

Explicitly out of scope for Phase 1

  • Attack testing (XSW, signature forgery, replay): deferred to Phase 4
  • Artifact binding and Attribute Query: deferred to Phase 2
  • Special behavior of IdP proxies and gateways: deferred to Phase 3
  • Performance, load, or intrusive testing: never in scope

Full inclusion and exclusion list in docs/01-scope-and-roadmap.md.