The underlying web interface, which is managed as an AdministrativeConfiguration, looks like this:
The same thing on the command line would be:
The parameters supported and their corresponding command line options are:
Required, identifies the relying party (SP) to simulate a resolution for
Required, names the subject/user to simulate a resolution for
Identifies the index of an
Value is ignored, if present causes the output to be encoded into a SAML 1.1 assertion
Value is ignored, if present causes the output to be encoded into a SAML 2.0 assertion
The tool essentially reproduces the results that would ordinarily be produced during a SSO or Attribute Query request. There are a couple of caveats to the reproduction of the results:
It bypasses any caching of results by data connectors so can occasionally provide different output, but this can help identify issues involving caching.
It can produce the same output under the assumption that plugins don't do unusual things that would be impossible to reproduce outside of a real transaction.
As an example of the second, if the resolution of data depended on some characteristic of the client, such as a network address, that would be unlikely to behave consistently, as would a scenario where the resolution of the data depended on details from the authentication process aside from just the canonicalized principal name.
V4.1 includes properties to control various aspects of the flow's behavior using an internally-defined bean that may be overridden if required.
The general properties configuring this flow via admin/admin.properties are:
To replace the internally defined flow descriptor bean, the following XML is required:
In older versions and upgraded systems, this list is defined in conf/admin/general-admin.xml. In V4.1+, no default version of the list is provided and it may simply be placed in conf/global.xml if needed.