Event log

Every SAML message and LDAP operation, as it went over the wire. This is what makes the tool more useful than a mock — you can read the actual assertion, not a guess at it.