🔑 Test IdP not signed in

Failure injection

Make the IdP misbehave in exactly one way and check that your SP notices. These toggles are global and persist in data/chaos.json.

SAML

pre-sign faults are signed correctly but wrong on the merits — they test your SP's semantic validation. post-sign faults break the signature itself — they test its cryptographic validation. Confusing the two is how a homemade test IdP ends up proving nothing.

Expired assertion pre-sign
NotOnOrAfter is one hour in the past.
expired-assertion Not yet valid (clock skew) pre-sign
NotBefore is one hour in the future.
future-assertion Wrong audience pre-sign
AudienceRestriction names a different SP.
wrong-audience Wrong destination pre-sign
Response Destination points somewhere else.
wrong-destination Mismatched InResponseTo pre-sign
InResponseTo does not match the AuthnRequest ID.
wrong-inresponseto Missing InResponseTo pre-sign
InResponseTo omitted from a solicited response.
drop-inresponseto Empty AttributeStatement pre-sign
Assertion carries no attributes at all.
no-attributes Wrong NameID format pre-sign
NameID Format is not the one the SP asked for.
wrong-nameid-format Wrong Recipient pre-sign
SubjectConfirmationData Recipient is not the ACS URL.
wrong-recipient StatusCode AuthnFailed response
Returns a SAML failure status instead of an assertion.
status-authnfailed StatusCode Responder response
Returns a generic IdP-side error status.
status-responder Unsigned assertion signing
Omits the Signature element entirely.
unsigned Tampered signature post-sign
Signs correctly, then alters an attribute value.
tampered-signature Corrupt digest post-sign
Signs correctly, then flips bytes in the DigestValue.
corrupt-digest Drop RelayState response
Omits RelayState, losing the SP deep link.
drop-relaystate Slow response (5s) response
Delays the response to trip SP timeouts.
slow-response Force re-authentication response
Ignores an existing session and demands a fresh login.
force-reauth

Currently active: 0