How SAML SSO Debugging Works: Decoding POST vs Redirect Bindings Explained

When debugging SAML-based single sign-on, developers often encounter a SAMLResponse that appears as binary garbage after Base64 decoding, which is caused by the HTTP-Redirect binding adding an extra DEFLATE compression layer beneath the Base64 encoding. The HTTP-POST binding uses simple Base64-encoded XML, while the HTTP-Redirect binding applies three layers — URL encoding, Base64, and raw DEFLATE compression — typically used for authentication requests and single logout flows. A critical distinction is that the Redirect binding uses raw DEFLATE per RFC 1951, without a zlib header or checksum, meaning standard zlib inflate calls will fail unless the correct wbits value of -15 is passed. Once decoded, the resulting XML assertion should be inspected for key fields including StatusCode, NameID format, timestamp conditions, AudienceRestriction, and signature presence to diagnose common SSO failures. Clock skew between identity and service providers and mismatched audience entity IDs are among the most frequent causes of SAML authentication errors.