...
Section 2.1.3 – errorURL
Implemented: X 16 June 2025
Description
The errorURL is a metadata element in an Identity Provider (IdP) configuration that points to a web page intended to help users troubleshoot login problems. When a user encounters an issue during authentication, a Relying Party (e.g. a Service Provider) may redirect the user to this URL for guidance or support. Including a valid and accessible errorURL enhances the user experience and aligns with SAML best practices.
...
Section 2.1.6 – SAML certificates (signing)
Implemented: X 16 June 2025
Description
A signing certificate is a critical part of an Identity Provider’s SAML metadata. It ensures that SAML assertions and metadata can be cryptographically validated by relying parties. The certificate is included via a <KeyDescriptor> element, either explicitly marked with use="signing" or with no use attribute at all.
...
Section 3.1.4 – SAML certificates (encryption)
Implemented: X 16 June 2025
Description
An encryption certificate is required in a Service Provider’s SAML metadata to allow Identity Providers to encrypt assertions. This certificate must be included using a <KeyDescriptor> element, either explicitly marked with use="encryption" or with no use attribute (which implies general-purpose use, including encryption).
...
Section 3.1.6 – Requested Attributes (SP)
Implemented: X 16 June 2025
Requirement
A Service Provider MUST include at least one AttributeConsumingService element.
...