{"id":37197956,"url":"https://github.com/mdeous/plasmid","last_synced_at":"2026-04-20T05:07:44.834Z","repository":{"id":61625428,"uuid":"540543167","full_name":"mdeous/plasmid","owner":"mdeous","description":"SAML IdP for SP security testing.","archived":false,"fork":false,"pushed_at":"2026-04-19T21:52:53.000Z","size":546,"stargazers_count":1,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-04-19T23:36:09.510Z","etag":null,"topics":["identity-provider","saml","saml-idp","security","sso"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mdeous.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-09-23T17:14:09.000Z","updated_at":"2026-04-19T21:52:56.000Z","dependencies_parsed_at":"2023-09-23T20:21:27.963Z","dependency_job_id":"a8bcec0e-8f3e-4740-82c9-61e138e9c121","html_url":"https://github.com/mdeous/plasmid","commit_stats":null,"previous_names":[],"tags_count":11,"template":false,"template_full_name":null,"purl":"pkg:github/mdeous/plasmid","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mdeous%2Fplasmid","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mdeous%2Fplasmid/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mdeous%2Fplasmid/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mdeous%2Fplasmid/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mdeous","download_url":"https://codeload.github.com/mdeous/plasmid/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mdeous%2Fplasmid/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32033735,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-20T00:18:06.643Z","status":"online","status_checked_at":"2026-04-20T02:00:06.527Z","response_time":94,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["identity-provider","saml","saml-idp","security","sso"],"created_at":"2026-01-14T23:00:15.183Z","updated_at":"2026-04-20T05:07:44.828Z","avatar_url":"https://github.com/mdeous.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# plasmid\n\n[![Build](https://github.com/mdeous/plasmid/actions/workflows/build.yml/badge.svg)](https://github.com/mdeous/plasmid/actions/workflows/build.yml)\n[![Docker Image](https://github.com/mdeous/plasmid/actions/workflows/docker.yml/badge.svg)](https://github.com/mdeous/plasmid/actions/workflows/docker.yml)\n[![License](https://img.shields.io/github/license/mdeous/plasmid)](https://github.com/mdeous/plasmid/blob/main/LICENSE)\n\nMinimal-configuration SAML identity provider for security testing of service provider implementations.\n\n\u003e :warning: **Warning**\n\u003e\n\u003e This application is strictly meant for testing SAML service providers, no authentication is (nor will be) implemented\n\u003e on the administration API endpoints it exposes. It MUST NOT be used as a production SAML IdP.\n\n---\n\n- [Introduction](#introduction)\n- [Features](#features)\n- [Installation](#installation)\n  - [From Source](#from-source)\n  - [Pre-built Binaries](#pre-built-binaries)\n- [Configuration](#configuration)\n- [Usage](#usage)\n  - [SP-initiated Flow](#sp-initiated-flow)\n  - [IdP-initiated Flow](#idp-initiated-flow)\n  - [Docker](#docker)\n  - [Interacting With a Running Instance](#interacting-with-a-running-instance)\n    - [Common Operations](#common-operations)\n  - [Web Dashboard](#web-dashboard)\n  - [API Endpoints](#api-endpoints)\n    - [SSO](#sso)\n    - [Service providers](#service-providers)\n    - [Users](#users)\n    - [Sessions](#sessions)\n    - [Identity provider initiated flow](#identity-provider-initiated-flow)\n    - [Identity provider initiated flow links management](#identity-provider-initiated-flow-links-management)\n- [Known Limitations](#known-limitations)\n- [License](#license)\n\n---\n\n## Introduction\n\nPlasmid is a SAML identity provider (IdP) based on the implementation from [`crewjam/saml`](https://github.com/crewjam/saml).\nIt is meant to run with minimal configuration and provide an easy way to test SAML service provider (SP) implementations.\n\n## Features\n\n- SP-initiated and IdP-initiated SAML SSO flows\n- Web dashboard for managing users, services, sessions, and shortcuts\n- SAML inspector for capturing and examining request/response exchanges\n- Assertion tampering for modifying SAML assertions on the fly:\n  - Signature manipulation (removal, empty SignatureValue, corrupt DigestValue)\n  - XML Signature Wrapping attacks (8 variants)\n  - XXE injection (local file read, SSRF, out-of-band exfiltration, custom DOCTYPE)\n  - XML comment injection in NameID values\n  - Override NameID, NameID format, Issuer, Audience, and RelayState\n  - Dynamic attribute injection and modification\n- SAML response replay from the inspector\n- CLI client for interacting with a running instance\n\n## Installation\n\n### From Source\n\nSimply clone the project and use the provided `Makefile` to build it:\n\n```bash\ngit clone github.com/mdeous/plasmid\ncd plasmid\nmake\n./plasmid -h\n```\n\n### Pre-built Binaries\n\nDownload the latest release for your plaform from the [releases](https://github.com/mdeous/plasmid/releases/latest)\npage. You can also live on the edge by using the [nightly](https://github.com/mdeous/plasmid/releases/tag/nightly)\nrelease, which always contains the latest changes from the `main` branch.\n\n## Configuration\n\nPlasmid can be started without any configuration, it will then automatically generate a certificate and\nprivate key and create a user in the idp (credentials: `admin:Password123`).\n\nThe default configuration can be overridden either with a YAML file named `plasmid.yaml` and located in\nthe current directory, or from environment variables. Some values can also be set from the command-line.\nEnvironment variables take precedence over the configuration file, and command line arguments take precedence\nover environment variables.\n\nAll the configuration entry names can be translated from their path in the YAML file to the environment\nvariable name by replacing `.` with `_`, converting it to upper case, and prepending `IDP_` to it.\nFor example the environment variable for the YAML entry `user.username` is `IDP_USER_USERNAME`.\n\nAn example YAML file with all the configurable options and their default values is provided in\n[`plasmid.example.yaml`](https://github.com/mdeous/plasmid/blob/69bc87be8ab5da2af2adb2af94efa692b7fae3b2/plasmid.example.yml)\nat the root of the project folder.\n\n## Usage\n\n### SP-initiated Flow\n\nThis example demonstrates how to setup a test environment using [`ngrok`](https://ngrok.com/)\n`plasmid` and [`SAMLRaider`](https://github.com/portswigger/saml-raider).\n\n- In a terminal, start a ngrok tunnel and copy the tunnel URL:\n\n```bash\nngrok http 8000\n```\n\n- In another terminal, generate the IdP certificate and private key, and start the server:\n\n```bash\n./plasmid serve -u \u003cngrok-url\u003e\n```\n\n- Using the generated `idp-metadata.xml` file (or the `\u003cbase-url\u003e/metadata` URL), register the plasmid\n  instance on the service provider you want to test\n- In [`SAMLRaider`](https://github.com/portswigger/saml-raider), import the certificate and private key\n- You can begin testing the service provider and login using `admin:Password123`\n\n### IdP-initiated Flow\n\n- Follow the steps described in the [SP-initiated example](#sp-initiated-flow) above to register the\n  plasmid instance on the service provider\n- Create a new link in plasmid for the service provider using the `client` command:\n\n```bash\n./plasmid client login-add -n \"\u003clink-name\u003e\" -e \"\u003csp-entity-id\u003e\"\n```\n\n- Start the IdP-initiated flow:\n\n```bash\n./plasmid client login \"\u003clogin-name\u003e\"\n```\n\n- A new browser window should open and prompt you for credentials (or directly redirect you to the SP if\n  you already have an active session)\n\n### Docker\n\nTo run plasmid with Docker, simply start the image and pass any needed arguments to it.\nOptionally, you can mount a configuration file to the container's `/plasmid/plasmid.yaml`\npath, or use environment variables.\n\n```bash\ndocker run ghcr.io/mdeous/plasmid:latest serve\n```\n\n### Interacting With a Running Instance\n\nThe `plasmid client` command provides a number of subcommands that can be used to interact with\na plasmid instance:\n\n```text\nInteract with a running Plasmid instance\n\nUsage:\n  plasmid client [command]\n\nAliases:\n  client, c\n\nAvailable Commands:\n  login        Start an idp initiated login flow (opens a browser)\n  login-add    Create a new idp initiated login link\n  login-del    Delete an idp initiated login link\n  login-list   List links for idp initiated login\n  session-del  Delete an active user session\n  session-get  Get details about an active user session\n  session-list List active user sessions\n  sp-add       Register a new service provider\n  sp-del       Delete a service provider\n  sp-list      List service providers\n  user-add     Create a new user account\n  user-del     Delete an user account\n  user-get     Get details about a user account\n  user-list    List user accounts\n\nFlags:\n  -h, --help         help for client\n      --url string   plasmid instance url (default \"http://127.0.0.1:8000\")\n\nUse \"plasmid client [command] --help\" for more information about a command.\n```\n\nEach subcommand can also be called using shorthand commands (e.g. `sg` instead of `session-get`),\nplease refer to the help of each of those to know more about their usage and the available shorthands.\n\n#### Common Operations\n\n- Adding a new user to the IdP:\n\n```bash\n./plasmid client user-add -u \"\u003cusername\u003e\" -e \"\u003cemail\u003e\" -p \"\u003cpassword\u003e\"\n```\n\n- Deleting an active user session:\n\n```bash\n# list active sessions ids\n./plasmid client session-list\n# delete the session\n./plasmid client session-del \"\u003csession-id\u003e\"\n```\n\n- Adding a new SP to the IdP:\n\n```bash\n./plasmid client sp-add -m \"\u003cmetadata_url_or_file\u003e\" -s \"\u003cservice-name\u003e\"\n```\n\n- Creating a new IdP-initiated login link:\n\n```bash\n./plasmid client login-add -n \"\u003clink-name\u003e\" -e \"\u003csp-entity-id\u003e\"\n```\n\n### Web Dashboard\n\nPlasmid includes a web dashboard accessible at `\u003cbase-url\u003e/ui/`. It provides pages for:\n\n- **Dashboard** — overview and stats\n- **Users** — manage IdP user accounts\n- **Services** — manage registered service providers\n- **Sessions** — view and manage active sessions\n- **Shortcuts** — manage IdP-initiated login links\n- **Inspector** — view captured SAML request/response exchanges in real time\n- **Tamper** — assertion tampering settings\n- **Settings** — view IdP certificate details\n\n### API Endpoints\n\nThe underlying IdP implementation exposes a number of API endpoints, this section merely exists\nas an inventory of those endpoints. Most of those can be easily queried using the\n[integrated client](#interacting-with-a-running-instance) via the `plasmid client` command.\n\nFor more information, please refer to the code of their handlers in [`crewjam/saml`](https://github.com/crewjam/saml),\nwhich are listed [in this file](https://github.com/crewjam/saml/blob/main/samlidp/samlidp.go#L86-L125).\n\n#### SSO\n\n| **Method**   | **Path**    | **Description**                    |\n| ------------ | ----------- | ---------------------------------- |\n| `GET`        | `/metadata` | get the identity provider metadata |\n| `GET`/`POST` | `/sso`      | generate SAML assertions           |\n\n#### Service providers\n\n| **Method**   | **Path**         | **Description**                  |\n| ------------ | ---------------- | -------------------------------- |\n| `GET`        | `/services/`     | list service providers           |\n| `GET`        | `/services/\u003cid\u003e` | get service provider metadata    |\n| `PUT`/`POST` | `/services/\u003cid\u003e` | add or update a service provider |\n| `DELETE`     | `/services/\u003cid\u003e` | delete a service provider        |\n\n#### Users\n\n| **Method** | **Path**            | **Description**                    |\n| ---------- | ------------------- | ---------------------------------- |\n| `GET`      | `/users/`           | list user accounts                 |\n| `GET`      | `/users/\u003cusername\u003e` | get information on an user account |\n| `PUT`      | `/users/\u003cusername\u003e` | add or update an user account      |\n| `DELETE`   | `/users/\u003cusername\u003e` | delete an user account             |\n\n#### Sessions\n\n| **Method** | **Path**         | **Description**                      |\n| ---------- | ---------------- | ------------------------------------ |\n| `GET`      | `/sessions/`     | list active sessions                 |\n| `GET`      | `/sessions/\u003cid\u003e` | get information on an active session |\n| `DELETE`   | `/sessions/\u003cid\u003e` | delete a session                     |\n\n#### Identity provider initiated flow\n\n| **Method**   | **Path**                           | **Description**            |\n| ------------ | ---------------------------------- | -------------------------- |\n| `GET`/`POST` | `/login`                           | login handler              |\n| `GET`        | `/login/\u003clink-name\u003e`               | begin flow                 |\n| `GET`        | `/login/\u003clink-name\u003e/\u003crelay-state\u003e` | begin flow with RelayState |\n\n#### Identity provider initiated flow links management\n\n| **Method** | **Path**                 | **Description**                                      |\n| ---------- | ------------------------ | ---------------------------------------------------- |\n| `GET`      | `/shortcuts/`            | list login links                                     |\n| `GET`      | `/shortcuts/\u003clink-name\u003e` | get information on a login link                      |\n| `PUT`      | `/shortcuts/\u003clink-name\u003e` | create or update a login link for a service provider |\n| `DELETE`   | `/shortcuts/\u003clink-name\u003e` | delete a login link                                  |\n\n## Known Limitations\n\n- Does not support signed SAML requests\n- Does not support encrypted SAML requests\n\n## License\n\nThis project is licensed under the MIT license. See the [LICENSE](https://github.com/mdeous/plasmid/blob/main/LICENSE) file for more information.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmdeous%2Fplasmid","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmdeous%2Fplasmid","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmdeous%2Fplasmid/lists"}