IAM Tracer

Trace and inspect OAuth 2.0, SAML, and OIDC authentication flows in the browser.

IAM Tracer is a developer and security engineer's companion for debugging authentication flows in the browser. It passively observes OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0 traffic as it happens and presents a structured, real-time timeline in the DevTools panel — no proxy to configure, no certificates to install, no traffic modification. WHAT IT CAPTURES • OAuth 2.0 — authorization code grants, implicit token flows, PKCE parameters, state values, and error responses • OIDC — token endpoint calls, discovery document fetches (.well-known/openid-configuration), and logout flows (end_session_endpoint) • SAML 2.0 — SAMLRequest and SAMLResponse POST bindings, decoded XML assertions, subject NameID, attributes, and status codes • JWT decoding — id_token and access_token claims decoded inline (header + payload), with an expiry status badge (valid / expiring / expired) ANALYSIS TOOLS • Auth Flow correlation — automatically links the authorization request, code callback, and token exchange belonging to the same login, matched by OAuth state • PKCE verification — detects mismatched code_verifier / code_challenge pairs so a broken PKCE flow is obvious immediately • Manual Decode — paste a raw JWT, an OAuth/OIDC redirect URL, or a SAML message (XML, POST binding, or Redirect binding) and decode it on its own, without a live capture • Export & Copy Flow — export all captured events to a timestamped JSON file, or copy a single correlated flow to the clipboard; redaction is on by default, and a warning dialog blocks unredacted export until you explicitly confirm HOW IT WORKS IAM Tracer hooks into browser navigation events and network request completions using standard Chrome extension APIs. SAML POST bodies are extracted from form submissions in the page DOM. All parsing happens locally in your browser. NO DATA LEAVES YOUR BROWSER All captured events are stored in chrome.storage.session — they exist only for the current browser session and are automatically cleared when you close the browser. Nothing is sent to any remote server. Pasted input in the Manual Decode view is never stored, logged, or included in exports. WHO IT'S FOR • Frontend and backend developers integrating OAuth / OIDC / SAML • Identity engineers debugging SSO flows • Security engineers auditing authentication protocol implementations • QA engineers testing authentication edge cases v0.1.1 Fixed: extension now captures events from the inspected tab only, not all open tabs Fixed: JWT claims and SAML assertions now decode and display correctly in the detail panel Fixed: Gmail and other non-OAuth pages no longer trigger false OAuth error events v0.1.3 — DevTools Panel UI Overhaul Event list • Protocol stripe: each event now has a 3px coloured left border (blue = OAuth, teal = OIDC, orange = SAML, red = error) so you can scan the list at a glance • Method badge: GET / POST shown in colour next to the event type • Status code badge: 200 in teal, 4xx/5xx in red • URL shown in monospace on a second line v0.1.4 — Export & Share Captured Auth Flows This release adds the ability to export and share captured authentication flows — the most requested feature since the initial release. Export captured auth flows Open the IAM Tracer DevTools panel, reproduce your OAuth or SAML flow, then click Export JSON. You get a timestamped JSON file containing all captured events in a structured schema v1 envelope. Redaction is on by default. Tokens, authorization codes, SAML XML, and PII claims are replaced before the file is written. Turn off the Redact checkbox only when you need raw credential data for local debugging — a blocking confirmation dialog warns you first. Copy a single flow Select any event in the list and click Copy Flow in the detail panel to copy just that correlated flow (all events sharing the same OAuth state) to the clipboard as JSON. Also in this release • JWT expiry badge — expired tokens are flagged visually in the detail panel • PKCE verification — mismatched code_verifier / code_challenge pairs are detected and shown • Auth flow correlation across request/response event pairs • DevTools panel layout overhaul No new permissions required Export uses an invisible <a download> element — the downloads permission is not required and was not added to the manifest. v0.1.8 — Manual Decode + SAML Redirect Binding Manual Decode view — a new "Decode" button in the DevTools panel toolbar lets you paste a JWT, an OAuth/OIDC redirect URL, or a SAML message and decode it without needing a live-captured event. Reuses the same JWT claim table / SAML assertion view as live capture. SAML Redirect binding support — previously only POST-binding SAML values (atob only) could be decoded; the decoder now also handles Redirect-binding values (base64 + raw DEFLATE), and that same inflate path benefits any pasted Redirect-binding message. v0.1.9 — Packaging Fix Fixed: the DevTools panel could fail to load in the packaged extension — a file required by the Export feature was missing from the build, so the panel silently broke after installing from the Web Store. Export and Decode now load reliably in every install. v0.1.10 — Modernized Panel + Reliability Fixes Redesigned the DevTools panel with a cleaner, modern look: pill-shaped protocol and status badges, card-style event list and detail sections, and a clearer Auth Flow table layout. Fixed: the Auth Flow view could show the same "Auth Request" row twice for one login. Fixed: event capture could silently stop for the rest of a browser session if local storage hit its limit; this now fails gracefully instead of breaking capture.