# SAML Metadata Extractor (`datamule/saml-metadata-extractor`) Actor Point at any SAML 2.0 identity-federation metadata feed (or MDQ service) and get one structured row per IdP/SP: endpoints, cert fingerprints, attributes, UI metadata. - **URL**: https://apify.com/datamule/saml-metadata-extractor.md - **Developed by:** [Datamule](https://apify.com/datamule) (community) - **Categories:** Developer tools - **Stats:** 2 total users, 0 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $0.35 / 1,000 entities This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## SAML Metadata Extractor Turn a SAML 2.0 federation feed or MDQ endpoint into export-ready IdP/SP inventory rows with the endpoints and trust metadata needed for federation reviews. ### Try it now ```json { "metadataUrl": "https://mds.swamid.se/md/swamid-idp.xml", "roleFilter": "all", "maxRecords": 25 } ```` This bounded example reads the current SWAMID IdP feed and emits at most 25 entity rows. ### Real output from SWAMID The row below came from a fresh isolated local run with the exact input above. The source returned HTTP 200 with 59 `` elements; the Actor emitted 25 unique rows, and this entity matched exactly once in the fetched XML. Only non-sensitive buyer fields are shown. | Entity ID | Role | Descriptors | Organization | Display name | SSO (Redirect) | Registrar | Source feed | | --- | --- | --- | --- | --- | --- | --- | --- | | `http://fs.liu.se/adfs/services/trust` | `both` | `IDPSSODescriptor`, `SPSSODescriptor` | Linköping University | Linköping University | `https://fs.liu.se/adfs/ls/` | `http://www.swamid.se/` | `https://mds.swamid.se/md/swamid-idp.xml` | ### What the Actor does Use either source shape: - an aggregate `` feed through `metadataUrl`; or - an MDQ service through `mdqBaseUrl`, optionally with one `entityId`. Each `` becomes one normalized dataset row. The parser matches XML elements by local name, so publisher-specific namespace prefixes do not change the result. Large feeds are downloaded to a temporary file and parsed incrementally; `maxRecords` stops row emission and parsing as soon as the cap is reached. ### Pricing | Item | FREE-tier price | | --- | ---: | | Billable event key | `entity` | | One emitted row | **$0.0005/entity** | | 1,000 emitted rows | **$0.50/1,000** | | Bounded example above, up to 25 rows | **maximum event charge $0.0125** | The Actor charges one `entity` event per emitted dataset row. A source that returns fewer than 25 matching entities incurs fewer events. These figures are event charges only and **exclude Apify infrastructure cost**, so they are not a total run-cost guarantee. ### Inputs Provide one source: | Field | Type | Description | | --- | --- | --- | | `metadataUrl` | string | URL of an aggregate SAML metadata feed, such as `https://mds.swamid.se/md/swamid-idp.xml`. | | `mdqBaseUrl` | string | Base URL of an MDQ service. With `entityId`, the Actor requests `{mdqBaseUrl}/entities/{url-encoded entityId}`. Without `entityId`, it requests `{mdqBaseUrl}/entities`. | | `entityId` | string | Exact SAML entity ID for a single-entity MDQ lookup. It is URL-encoded automatically and ignored when `metadataUrl` is set. | Optional controls: | Field | Type | Default | Description | | --- | --- | --- | --- | | `roleFilter` | string | `all` | `all` keeps every entity; `idp` keeps Identity Providers; `sp` keeps Service Providers. | | `maxRecords` | integer | `25` | Global cap on emitted entities and billable `entity` events. Minimum: 1. Raise it explicitly for a larger harvest. | | `bearer` | string | none | Bearer token for a gated deployment. The value is treated as secret and is not logged. | | `extraHeaders` | object | none | Additional request headers for a gated service. Header values are not logged. | Single-entity MDQ example: ```json { "mdqBaseUrl": "https://mdq.incommon.org", "entityId": "https://shib.oit.duke.edu/shibboleth", "maxRecords": 1 } ``` ### Dataset overview The Console overview contains exactly these ten fields from `dataset_schema.json`, in this order: | Field | Console label | What it contains | | --- | --- | --- | | `entityID` | Entity ID | Unique SAML entity identifier. | | `_role` | Role | Normalized role: `idp`, `sp`, `both`, `aa`, or `other`. | | `roles` | Descriptors | SAML role descriptor names published by the entity. | | `organizationDisplayName` | Organization | Preferred organization display name. | | `mduiDisplayName` | Display name | Preferred MDUI display name. | | `ssoRedirectLocation` | SSO (Redirect) | HTTP-Redirect SSO endpoint, or the first SSO endpoint when no Redirect binding exists. | | `registrationAuthority` | Registrar | Registration authority URI from metadata. | | `technicalContactEmail` | Technical contact | Public technical contact email when supplied by the federation. | | `signingCertFingerprints` | Signing certs (SHA-256) | SHA-256 fingerprints for signing certificates. | | `_source` | Source feed | Exact feed or MDQ URL fetched for the run. | ### Full output fields The export retains additional nullable fields for deeper analysis: | Field group | Fields | | --- | --- | | Identity and roles | `_type`, `_entityCount`, `isIdP`, `isSP`, `isAA` | | SAML endpoints | `ssoEndpoints`, `sloEndpoints`, `artifactResolutionEndpoints`, `assertionConsumerServices` | | Protocol capabilities | `nameIDFormats`, `scopes`, `requestedAttributes` | | Certificate metadata | `signingCertFingerprints`, `encryptionCertFingerprints`, `certificates` | | Organization and UI | `organizationName`, `organizationURL`, `mduiDescription`, `mduiLogo` | | Contacts | `contacts`, `supportContactEmail` | | Registration and assurance | `entityCategories`, `assuranceCertifications` | | Source XML | `_raw` | Every optional field is nullable. The structured certificate fields contain SHA-256 fingerprints, not certificate bodies. `_raw` contains the parsed entity reserialized as XML (up to 1,000,000 characters) and can include public X.509 certificate bodies from the feed; omit `_raw` downstream when it is not required. ### Common uses - Inventory IdPs and SPs across a federation. - Compare SSO/SLO endpoints before a federation or trust-store migration. - Find registration authorities, entity categories, assurance profiles, and requested attributes. - Export normalized federation metadata to JSON, CSV, Excel, or a downstream data pipeline. - Look up one entity from an MDQ service without writing XML or namespace-handling code. ### Coverage, freshness, and operator terms - The Actor fetches the source at run time and does not serve a cached federation snapshot. Output reflects what the named operator returned during that run; publication and refresh schedules are controlled by the operator. - Feed and MDQ availability, rate limits, acceptable-use rules, and metadata terms remain the source operator's responsibility. Confirm the operator's current terms before high-volume or repeated runs. - Public federation metadata is intended for interoperability, but a public URL does not establish that every field is suitable for every downstream purpose. Handle public contact fields according to applicable policy and law. - The Actor parses metadata and extracts certificate fingerprints; it does not validate XML signatures, certificate chains, federation membership, or trustworthiness. Apply the relevant federation trust policy before using output for access-control decisions. - Aggregate feeds are capped at 512 MB per download. `maxRecords` bounds emitted rows and event charges, but it does not make the source response itself smaller. ### Troubleshooting | Problem | What to check | | --- | --- | | Malformed XML, HTML, or a 404 body | Open the exact source URL and confirm it returns SAML `` or `` XML. The Actor fails clearly instead of converting an error page into an empty dataset. | | Zero entities after role filtering | Retry with `roleFilter: "all"`. An IdP-only feed can legitimately return zero rows with `sp`, and an SP-only feed can return zero rows with `idp`. | | Oversized feed | The download ceiling is 512 MB. Use the operator's smaller role-specific feed or MDQ service, or request a narrower source; increasing `maxRecords` does not bypass the byte ceiling. | | MDQ lookup fails | Verify the MDQ base, the exact case-sensitive `entityId`, and whether the service supports `GET /entities/{encoded-entityID}`. The Actor URL-encodes the entity ID; a 404 usually means the entity is absent from that MDQ service. | ### Finding federation sources Federation operators normally publish aggregate-feed and MDQ endpoints in their technical documentation. MDQ services follow the [SAML Metadata Query protocol](https://www.ietf.org/archive/id/draft-young-md-query-17.html): `GET {base}/entities/{url-encoded entityID}`. # Actor input Schema ## `metadataUrl` (type: `string`): URL of a SAML 2.0 metadata feed — normally an aggregate that lists every IdP and SP in an identity federation. One feed can hold thousands of entities. Examples: https://mds.swamid.se/md/swamid-idp.xml (SWAMID / Sweden), http://metadata.ukfederation.org.uk/ukfederation-metadata.xml (UK Access Management Federation), https://mds.edugain.org/edugain-v2.xml (eduGAIN, the global interfederation). One actor works against any of them. Provide THIS or an mdqBaseUrl. ## `mdqBaseUrl` (type: `string`): Base URL of a SAML Metadata Query (MDQ) service, used with entityId to fetch one entity's metadata as {mdqBaseUrl}/entities/{url-encoded entityId}. Leave entityId empty to request the whole aggregate ({mdqBaseUrl}/entities). Example: https://mdq.incommon.org (InCommon / US). Provide this OR metadataUrl. ## `entityId` (type: `string`): The SAML entityID to look up via the MDQ service (used with mdqBaseUrl). This is the entity's unique SAML identifier, e.g. https://samltest.id/saml/idp. It is URL-encoded automatically. Ignored when metadataUrl is set. ## `roleFilter` (type: `string`): Which entities to emit. all (default) keeps every entity; idp keeps only Identity Providers (entities with an IDPSSODescriptor); sp keeps only Service Providers (entities with an SPSSODescriptor). An entity that is both is kept by idp and by sp. ## `maxRecords` (type: `integer`): A GLOBAL cap on the total number of entities to emit: one `entity` PPE event per emitted row. FREE $0.0005/entity; the prefilled cap of 25 has a maximum example event charge $0.0125. This event charge excludes Apify infrastructure cost. Parsing streams entity-by-entity and stops as soon as the cap is reached; raise the cap to harvest more entities. ## `bearer` (type: `string`): Optional bearer token for gated metadata deployments (sent as Authorization: Bearer \*\*\*). Not required for public federation metadata. Never logged. ## `extraHeaders` (type: `object`): Optional extra HTTP headers as a JSON object, e.g. {"x-api-key": "..."} for gated services. Not required for public feeds. Header values are never logged. ## Actor input object example ```json { "metadataUrl": "https://mds.swamid.se/md/swamid-idp.xml", "roleFilter": "all", "maxRecords": 25 } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "metadataUrl": "https://mds.swamid.se/md/swamid-idp.xml", "maxRecords": 25 }; // Run the Actor and wait for it to finish const run = await client.actor("datamule/saml-metadata-extractor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "metadataUrl": "https://mds.swamid.se/md/swamid-idp.xml", "maxRecords": 25, } # Run the Actor and wait for it to finish run = client.actor("datamule/saml-metadata-extractor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "metadataUrl": "https://mds.swamid.se/md/swamid-idp.xml", "maxRecords": 25 }' | apify call datamule/saml-metadata-extractor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=datamule/saml-metadata-extractor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "SAML Metadata Extractor", "description": "Point at any SAML 2.0 identity-federation metadata feed (or MDQ service) and get one structured row per IdP/SP: endpoints, cert fingerprints, attributes, UI metadata.", "version": "0.1", "x-build-id": "pRnRn8mk3EVK0xhrR" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/datamule~saml-metadata-extractor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-datamule-saml-metadata-extractor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/datamule~saml-metadata-extractor/runs": { "post": { "operationId": "runs-sync-datamule-saml-metadata-extractor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/datamule~saml-metadata-extractor/run-sync": { "post": { "operationId": "run-sync-datamule-saml-metadata-extractor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "metadataUrl": { "title": "SAML metadata feed URL (aggregate)", "type": "string", "description": "URL of a SAML 2.0 metadata feed — normally an aggregate that lists every IdP and SP in an identity federation. One feed can hold thousands of entities. Examples: https://mds.swamid.se/md/swamid-idp.xml (SWAMID / Sweden), http://metadata.ukfederation.org.uk/ukfederation-metadata.xml (UK Access Management Federation), https://mds.edugain.org/edugain-v2.xml (eduGAIN, the global interfederation). One actor works against any of them. Provide THIS or an mdqBaseUrl." }, "mdqBaseUrl": { "title": "MDQ base URL (per-entity)", "type": "string", "description": "Base URL of a SAML Metadata Query (MDQ) service, used with entityId to fetch one entity's metadata as {mdqBaseUrl}/entities/{url-encoded entityId}. Leave entityId empty to request the whole aggregate ({mdqBaseUrl}/entities). Example: https://mdq.incommon.org (InCommon / US). Provide this OR metadataUrl." }, "entityId": { "title": "Entity ID (for MDQ lookup)", "type": "string", "description": "The SAML entityID to look up via the MDQ service (used with mdqBaseUrl). This is the entity's unique SAML identifier, e.g. https://samltest.id/saml/idp. It is URL-encoded automatically. Ignored when metadataUrl is set." }, "roleFilter": { "title": "Role filter", "enum": [ "all", "idp", "sp" ], "type": "string", "description": "Which entities to emit. all (default) keeps every entity; idp keeps only Identity Providers (entities with an IDPSSODescriptor); sp keeps only Service Providers (entities with an SPSSODescriptor). An entity that is both is kept by idp and by sp.", "default": "all" }, "maxRecords": { "title": "Max records (global cap)", "minimum": 1, "type": "integer", "description": "A GLOBAL cap on the total number of entities to emit: one `entity` PPE event per emitted row. FREE $0.0005/entity; the prefilled cap of 25 has a maximum example event charge $0.0125. This event charge excludes Apify infrastructure cost. Parsing streams entity-by-entity and stops as soon as the cap is reached; raise the cap to harvest more entities.", "default": 25 }, "bearer": { "title": "Bearer token", "type": "string", "description": "Optional bearer token for gated metadata deployments (sent as Authorization: Bearer ***). Not required for public federation metadata. Never logged." }, "extraHeaders": { "title": "Extra request headers", "type": "object", "description": "Optional extra HTTP headers as a JSON object, e.g. {\"x-api-key\": \"...\"} for gated services. Not required for public feeds. Header values are never logged." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```