Skip to content
This page is also available in your language. Switch

Sync settings

Choose what your account keeps in step on every device where you are signed in.

  • My tools

    Always synced: the tools on your board, their order and size.

  • The windows open on your start page, including what you typed in them.

  • Every note in the notepad – on the notepad page, on your board and in windows.

  • Every list of website shortcuts – on the shortcuts page, on your board and in windows.

  • Every grid in the cover grid maker – on its page, on your board and in windows.

  • Every list of bookmarked organisations in the OIN lookup – on its page, on your board and in windows.

  • Keeps your pipeline and saved recipes on all your devices. Your files are never synced – only the steps and settings.

Turning something off removes it from your account straight away. Your devices keep their own copy.

Notifications

Tools that can tell you about something new while a Synsi tab is open, even when you are in another tab or app. Choose them for this browser.

This browser cannot show notifications from websites.
Notifications are blocked for this site. Allow them in your browser’s site settings (the icon left of the address), then switch them on here.

  • Says “New message” while a Synsi tab is open – never who wrote it or what.

Your choice is stored in this browser only. Notifications never show personal content such as a message or a number. They work while a Synsi tab is open; closed tabs get none.

Browse all tools →

eID 4.4 SAML Validator – Check DV and LC Metadata

Check SAML metadata of a service provider (DV) or an LC bundle against the eID SAML 4.4 interface specification before you submit it.

My tools →

DV metadata (EntityDescriptor) or an LC bundle (EntitiesDescriptor), up to 10 MB. Nothing is stored.

An https:// address. The metadata is fetched by our server, following up to 5 redirects.

Checks follow eID SAML 4.4 of the Afsprakenstelsel Elektronische Toegangsdiensten. The certificate chain is not verified against the PKIoverheid roots, and a passing result is no substitute for the official connection test.

Also available via our free API

How to use the eID 4.4 SAML Validator

  1. 1 Paste the metadata XML, choose or drop an XML file, or switch to “Fetch from URL” and enter the https address of the metadata.
  2. 2 Click “Validate metadata”.
  3. 3 Read the summary, fix the errors and warnings shown with each check and its section in eID SAML 4.4, and validate again.

What the validator checks

The validator follows the Koppelvlakspecificatie eID SAML 4.4, the SAML profile for service providers in the Dutch eID system (urn:nl-eid-gdi entityIDs). Each result names the section it comes from.

  • XML and schema – well-formed XML, the OASIS SAML 2.0 metadata schema, unique ID attributes and the metadata namespace.
  • Document – an ID on the root element, validUntil or cacheDuration, one SPSSODescriptor, and AuthnRequestsSigned and WantAssertionsSigned set to true.
  • Keys and certificates – a signing and an encryption KeyDescriptor with KeyName and X509Certificate; PKIoverheid issuer, at least 2048-bit keys, validity, key usage, the PKIoverheid certificate policy and the OIN in the certificate.
  • Signature – an enveloped signature on the root element with exclusive canonicalization, RSA-SHA256 or stronger and a SHA-256 digest, verified cryptographically against the signing certificate in the metadata.
  • entityID – the form urn:nl-eid-gdi:1.0:<ROLE>:<OIN>:entities:<index>, an SP role (DV or LC), a 4-digit index (9000-9999 is for test systems) and the same OIN as the signing certificate.
  • Endpoints and services – AssertionConsumerService with the HTTP-Artifact binding, unique indexes and one default; SingleLogoutService with HTTP-POST; AttributeConsumingService with ServiceName and a ServiceUUID; every URL on public https.
  • Algorithms – no SHA-1 or ECDSA; AES-256-CBC and RSA-OAEP for encryption.

DV metadata and LC bundles

A dienstverlener (DV) publishes an EntityDescriptor. A leverancier clusteraansluiting (LC) publishes an EntitiesDescriptor with its own LC entity and one entity per connected DV. For a bundle the validator also checks that there is exactly one LC entity, at least one DV entity, no duplicate entityIDs, and that the bundle is signed with the LC's certificate.

What it does not check

The signature is verified against the certificate in the metadata, but the certificate chain is not checked against the PKIoverheid roots, and whether a certificate is PKIoverheid is judged by its issuer. A clean result helps you prepare, but it does not replace the connection test of your broker or the authority.

Privacy

Metadata is public information. Pasted and uploaded metadata is validated on our server and not stored. URLs are fetched only over https and only from public internet addresses.

Sources

Frequently asked questions

Which metadata can I validate?

Service provider metadata: an EntityDescriptor of a dienstverlener (DV), or an EntitiesDescriptor of a leverancier clusteraansluiting (LC) with its DV entities.

Why is the signature valid but the certificate trust only a warning?

The validator verifies the signature against the certificate in the metadata. It does not check that certificate’s chain up to the PKIoverheid root, so check that separately.

What does the entityID index 9000-9999 mean?

Indexes 0000-8999 are for production systems; 9000-9999 are reserved for test systems.

Is my metadata stored?

No. It is validated and then discarded. Use the URL option to validate published metadata directly.

How large may the metadata be?

Up to 10 MB, enough for LC bundles with many DVs.

Last updated: