Two ways to run it.

Use the hosted app for the quickest path to a shareable result, or run the Suite yourself when the target can't leave your network.

Hosted

app.samlscope.com

No install. Runs on the official Hosted service, which can turn a completed Run into a shareable, traceable URL.

Open the app
Self-host

Run from source or Docker

Keeps everything on your own infrastructure. Results are self-declared local files: result.json and a self-contained report.html.

Jump to setup

Requirements

  • Java 21to build and run the Suite
  • Node.js 20.19+for frontend development only
  • Docker or Apple Containeroptional, for containerized deployment or the Keycloak fixture

Self-host setup

Run from source

./gradlew check
SAMLSCOPE_IMAGE_DIGEST="sha256:<digest-of-the-build-you-are-running>" \
SAMLSCOPE_DATA_DIR="$PWD/data" ./gradlew :api:run

Open http://localhost:8080. Runtime state, generated Test Peer keys, cached metadata, and redacted Transcripts are stored below SAMLSCOPE_DATA_DIR.

Or run with Docker

docker build -t samlscope:0.1.0 .
IMAGE_DIGEST="$(docker image inspect --format '{{.Id}}' samlscope:0.1.0)"
docker run --rm -p 8080:8080 -v samlscope-data:/data \
  -e SAMLSCOPE_PUBLIC_BASE_URL=http://localhost:8080 \
  -e SAMLSCOPE_PEER_BASE_URL=http://localhost:8080 \
  -e SAMLSCOPE_IMAGE_DIGEST="$IMAGE_DIGEST" \
  samlscope:0.1.0

Self-hosted mode has no application authentication and must not be exposed directly to an untrusted network. Generated Test Peer private keys are test-only and must never be trusted by production systems.

No IdP handy? Use the Keycloak fixture

SAMLSCOPE_SMOKE_MANUAL=1 dev/keycloak/prepare-smoke.sh

Provisions a disposable Keycloak target for browser testing, and is never used as conformance evidence itself. Apple Container on macOS: python3 dev/keycloak/prepare-smoke-apple.py --manual

First run

Running a test

  1. Create a Test Plan for an IdP or SP you're authorized to test.
  2. Enter its entity ID and metadata URL, then run Preflight.
  3. Register the displayed SAMLscope Test Peer metadata in the target.
  4. Start the initial browser round trip, using a non-production test account.
  5. Run or resume M1, M2, and M3 as required by the selected evidence plan.
  6. Follow the operation prompts. SAMLscope completes protocol-driven cases as correlated evidence arrives.
  7. Review the result and export result.json or the self-contained report.html.

Use a fresh or private browser context when instructed. Positive and negative controls must both have sufficient evidence before an evaluative case can complete.