IAM Tracer

Trace and inspect OAuth 2.0, SAML, and OIDC authentication flows in the browser.

IAM Tracer is a developer and security engineer's companion for debugging authentication flows in the browser. It passively observes OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0 traffic as it happens and presents a structured, real-time timeline in the DevTools panel — no proxy to configure, no certificates to install, no traffic modification. WHAT IT CAPTURES • OAuth 2.0 — authorization code grants, implicit token flows, PKCE parameters, state values, and error responses • OIDC — token endpoint calls, discovery document fetches (.well-known/openid-configuration), and logout flows (end_session_endpoint) • SAML 2.0 — SAMLRequest and SAMLResponse POST bindings, decoded XML assertions, subject NameID, attributes, and status codes • JWT decoding — id_token and access_token claims decoded inline (header + payload) HOW IT WORKS IAM Tracer hooks into browser navigation events and network request completions using standard Chrome extension APIs. SAML POST bodies are extracted from form submissions in the page DOM. All parsing happens locally in your browser. NO DATA LEAVES YOUR BROWSER All captured events are stored in chrome.storage.session — they exist only for the current browser session and are automatically cleared when you close the browser. Nothing is sent to any remote server. WHO IT'S FOR • Frontend and backend developers integrating OAuth / OIDC / SAML • Identity engineers debugging SSO flows • Security engineers auditing authentication protocol implementations • QA engineers testing authentication edge cases v0.1.1 Fixed: extension now captures events from the inspected tab only, not all open tabs Fixed: JWT claims and SAML assertions now decode and display correctly in the detail panel Fixed: Gmail and other non-OAuth pages no longer trigger false OAuth error events v0.1.3 — DevTools Panel UI Overhaul Event list Protocol stripe: each event now has a 3px coloured left border (blue = OAuth, teal = OIDC, orange = SAML, red = error) so you can scan the list at a glance Method badge: GET / POST shown in colour next to the event type Status code badge: 200 in teal, 4xx/5xx in red URL shown in monospace on a second line v0.1.4 This release adds the ability to export and share captured authentication flows — the most frequently requested feature since the initial release. # Export captured auth flows Open the IAM Tracer DevTools panel, reproduce your OAuth or SAML flow, then click **Export JSON**. You get a timestamped JSON file containing all captured events in a structured schema v1 envelope. **Redaction is on by default.** Tokens, authorization codes, SAML XML, and PII claims are replaced before the file is written. Turn off the **Redact** checkbox only when you need raw credential data for local debugging — a blocking confirmation dialog will warn you first. #Copy a single flow Select any event in the list and click **Copy Flow** in the detail panel to copy just that correlated flow (all events sharing the same OAuth `state`) to the clipboard as JSON. #Also in this release - JWT expiry badge — expired tokens are flagged visually in the detail panel - PKCE verification — mismatched `code_verifier` / `code_challenge` pairs are detected and shown - Auth flow correlation across request/response event pairs - DevTools panel layout overhaul #No new permissions required Export uses an invisible `<a download>` element — the `downloads` permission is not required and was not added to the manifest.