SAML Metadata Extractor

Turn a SAML 2.0 federation feed or MDQ endpoint into export-ready IdP/SP inventory rows with the endpoints and trust metadata needed for federation reviews.

Try it now

{
  "metadataUrl": "https://mds.swamid.se/md/swamid-idp.xml",
  "roleFilter": "all",
  "maxRecords": 25
}

This bounded example reads the current SWAMID IdP feed and emits at most 25 entity rows.

Real output from SWAMID

The row below came from a fresh isolated local run with the exact input above. The source returned HTTP 200 with 59 <EntityDescriptor> elements; the Actor emitted 25 unique rows, and this entity matched exactly once in the fetched XML. Only non-sensitive buyer fields are shown.

Entity ID	Role	Descriptors	Organization	Display name	SSO (Redirect)	Registrar	Source feed
http://fs.liu.se/adfs/services/trust	both	IDPSSODescriptor, SPSSODescriptor	Linköping University	Linköping University	https://fs.liu.se/adfs/ls/	http://www.swamid.se/	https://mds.swamid.se/md/swamid-idp.xml

What the Actor does

Use either source shape:

• an aggregate <EntitiesDescriptor> feed through metadataUrl; or
• an MDQ service through mdqBaseUrl, optionally with one entityId.

Each <EntityDescriptor> becomes one normalized dataset row. The parser matches XML elements by local name, so publisher-specific namespace prefixes do not change the result. Large feeds are downloaded to a temporary file and parsed incrementally; maxRecords stops row emission and parsing as soon as the cap is reached.

Pricing

Item	FREE-tier price
Billable event key	entity
One emitted row	$0.0005/entity
1,000 emitted rows	$0.50/1,000
Bounded example above, up to 25 rows	maximum event charge $0.0125

The Actor charges one entity event per emitted dataset row. A source that returns fewer than 25 matching entities incurs fewer events. These figures are event charges only and exclude Apify infrastructure cost, so they are not a total run-cost guarantee.

Inputs

Provide one source:

Field	Type	Description
metadataUrl	string	URL of an aggregate SAML metadata feed, such as https://mds.swamid.se/md/swamid-idp.xml.
mdqBaseUrl	string	Base URL of an MDQ service. With entityId, the Actor requests {mdqBaseUrl}/entities/{url-encoded entityId}. Without entityId, it requests {mdqBaseUrl}/entities.
entityId	string	Exact SAML entity ID for a single-entity MDQ lookup. It is URL-encoded automatically and ignored when metadataUrl is set.

Optional controls:

Field	Type	Default	Description
roleFilter	string	all	all keeps every entity; idp keeps Identity Providers; sp keeps Service Providers.
maxRecords	integer	25	Global cap on emitted entities and billable entity events. Minimum: 1. Raise it explicitly for a larger harvest.
bearer	string	none	Bearer token for a gated deployment. The value is treated as secret and is not logged.
extraHeaders	object	none	Additional request headers for a gated service. Header values are not logged.

Single-entity MDQ example:

{
  "mdqBaseUrl": "https://mdq.incommon.org",
  "entityId": "https://shib.oit.duke.edu/shibboleth",
  "maxRecords": 1
}

Dataset overview

The Console overview contains exactly these ten fields from dataset_schema.json, in this order:

Field	Console label	What it contains
entityID	Entity ID	Unique SAML entity identifier.
_role	Role	Normalized role: idp, sp, both, aa, or other.
roles	Descriptors	SAML role descriptor names published by the entity.
organizationDisplayName	Organization	Preferred organization display name.
mduiDisplayName	Display name	Preferred MDUI display name.
ssoRedirectLocation	SSO (Redirect)	HTTP-Redirect SSO endpoint, or the first SSO endpoint when no Redirect binding exists.
registrationAuthority	Registrar	Registration authority URI from metadata.
technicalContactEmail	Technical contact	Public technical contact email when supplied by the federation.
signingCertFingerprints	Signing certs (SHA-256)	SHA-256 fingerprints for signing certificates.
_source	Source feed	Exact feed or MDQ URL fetched for the run.

Full output fields

The export retains additional nullable fields for deeper analysis:

Field group	Fields
Identity and roles	_type, _entityCount, isIdP, isSP, isAA
SAML endpoints	ssoEndpoints, sloEndpoints, artifactResolutionEndpoints, assertionConsumerServices
Protocol capabilities	nameIDFormats, scopes, requestedAttributes
Certificate metadata	signingCertFingerprints, encryptionCertFingerprints, certificates
Organization and UI	organizationName, organizationURL, mduiDescription, mduiLogo
Contacts	contacts, supportContactEmail
Registration and assurance	entityCategories, assuranceCertifications
Source XML	_raw

Every optional field is nullable. The structured certificate fields contain SHA-256 fingerprints, not certificate bodies. _raw contains the parsed entity reserialized as XML (up to 1,000,000 characters) and can include public X.509 certificate bodies from the feed; omit _raw downstream when it is not required.

Common uses

• Inventory IdPs and SPs across a federation.
• Compare SSO/SLO endpoints before a federation or trust-store migration.
• Find registration authorities, entity categories, assurance profiles, and requested attributes.
• Export normalized federation metadata to JSON, CSV, Excel, or a downstream data pipeline.
• Look up one entity from an MDQ service without writing XML or namespace-handling code.

Coverage, freshness, and operator terms

• The Actor fetches the source at run time and does not serve a cached federation snapshot. Output reflects what the named operator returned during that run; publication and refresh schedules are controlled by the operator.
• Feed and MDQ availability, rate limits, acceptable-use rules, and metadata terms remain the source operator's responsibility. Confirm the operator's current terms before high-volume or repeated runs.
• Public federation metadata is intended for interoperability, but a public URL does not establish that every field is suitable for every downstream purpose. Handle public contact fields according to applicable policy and law.
• The Actor parses metadata and extracts certificate fingerprints; it does not validate XML signatures, certificate chains, federation membership, or trustworthiness. Apply the relevant federation trust policy before using output for access-control decisions.
• Aggregate feeds are capped at 512 MB per download. maxRecords bounds emitted rows and event charges, but it does not make the source response itself smaller.

Troubleshooting

Problem	What to check
Malformed XML, HTML, or a 404 body	Open the exact source URL and confirm it returns SAML <EntitiesDescriptor> or <EntityDescriptor> XML. The Actor fails clearly instead of converting an error page into an empty dataset.
Zero entities after role filtering	Retry with roleFilter: "all". An IdP-only feed can legitimately return zero rows with sp, and an SP-only feed can return zero rows with idp.
Oversized feed	The download ceiling is 512 MB. Use the operator's smaller role-specific feed or MDQ service, or request a narrower source; increasing maxRecords does not bypass the byte ceiling.
MDQ lookup fails	Verify the MDQ base, the exact case-sensitive entityId, and whether the service supports GET /entities/{encoded-entityID}. The Actor URL-encodes the entity ID; a 404 usually means the entity is absent from that MDQ service.

Finding federation sources

Federation operators normally publish aggregate-feed and MDQ endpoints in their technical documentation. MDQ services follow the SAML Metadata Query protocol: GET {base}/entities/{url-encoded entityID}.