Debugging SAML SSO: How to Decode a SAMLResponse (and Why It's Sometimes Not XML)

You're debugging a broken SSO login. The identity provider (IdP) redirects back to your app, and somewhere in the request is a big blob called SAMLResponse . You grab it, Base64-decode it, and expect ...