xmllint

SAML carries its messages as XML, which arrives on one long line. xmllint --format reindents it so the <saml:Assertion>, its <saml:Issuer>, <saml:Subject> and <ds:Signature> can be read; --noout parses it and prints nothing, so a non-zero exit means it is not well-formed; --xpath picks one node out. It only reads the document — it does not check a signature (that is xmlsec1), and reformatting a signed document can change the bytes a signature was made over, so verify first.

xmllint command usage

xmllint [--format] [--noout] [--xpath EXPR] FILE

Options

--format

reindent the XML so it can be read

--noout

parse only, print nothing (exit non-zero if not well-formed)

--xpath 'EXPR'

print the nodes an XPath expression selects

--nonet

never fetch a DTD or schema over the network

xmllint examples

xmllint --format /root/saml-response.xml

Reindents the signed SAML Response so its elements can be read.

xmllint --noout /root/saml-response.xml

Parses the XML and prints nothing if it is well-formed.

xmllint --xpath '//*[local-name()="Issuer"]/text()' /root/saml-response.xml

Prints the issuer named inside the SAML message.

Reading the output

$ xmllint --format /root/saml-response.xml
<?xml version="1.0"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ...>
  <saml:Issuer>http://idp.lab/saml</saml:Issuer>
  <saml:Assertion ID="_a1b2c3" ...>
    <saml:Subject>
      <saml:NameID ...>alice@office.lab</saml:NameID>
    ...

• --format only reprints; it does not change the file on disk.
• A parse error means the input is not well-formed XML (an error page, or truncated output).

Pitfalls

• xmllint reads XML; it says nothing about whether a signature is valid — use xmlsec1 --verify for that.
• Reindenting a signed document with --format can change the canonical bytes, so verify the original, not a reformatted copy.

Run it on real machines