Overview
Trace and inspect OAuth 2.0, SAML, and OIDC authentication flows in the browser.
IAM Tracer is a developer and security engineer's companion for debugging authentication flows in the browser. It passively observes OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0 traffic as it happens and presents a structured, real-time timeline in the DevTools panel — no proxy to configure, no certificates to install, no traffic modification. WHAT IT CAPTURES • OAuth 2.0 — authorization code grants, implicit token flows, PKCE parameters, state values, and error responses • OIDC — token endpoint calls, discovery document fetches (.well-known/openid-configuration), and logout flows (end_session_endpoint) • SAML 2.0 — SAMLRequest and SAMLResponse POST bindings, decoded XML assertions, subject NameID, attributes, and status codes • JWT decoding — id_token and access_token claims decoded inline (header + payload) HOW IT WORKS IAM Tracer hooks into browser navigation events and network request completions using standard Chrome extension APIs. SAML POST bodies are extracted from form submissions in the page DOM. All parsing happens locally in your browser. NO DATA LEAVES YOUR BROWSER All captured events are stored in chrome.storage.session — they exist only for the current browser session and are automatically cleared when you close the browser. Nothing is sent to any remote server. WHO IT'S FOR • Frontend and backend developers integrating OAuth / OIDC / SAML • Identity engineers debugging SSO flows • Security engineers auditing authentication protocol implementations • QA engineers testing authentication edge cases
Details
- Version0.1.0
- UpdatedAugust 28, 2026
- Offered byhtunn
- Size19.05KiB
- LanguagesEnglish (United States)
- Developer
Email
htunnthuthu.tech@gmail.com - Non-traderThis developer has not identified itself as a trader. For consumers in the European Union, please note that consumer rights do not apply to contracts between you and this developer.
Privacy
This developer declares that your data is
- Not being sold to third parties, outside of the approved use cases
- Not being used or transferred for purposes that are unrelated to the item's core functionality
- Not being used or transferred to determine creditworthiness or for lending purposes
