Auth Flow Inspector

Version 1.0.0

Documentation

Enterprise Authentication Flow Inspector is a Manifest V3 Chrome DevTools extension for investigating browser-visible authentication, SSO, federation and authorization traffic.

New to the extension? Follow the step-by-step Getting Started walkthrough for a complete capture, inspection, Flow Analysis, and report-export workflow. When investigating a failure, use the protocol-specific troubleshooting tutorials.

Install from the Chrome Web Store

Install the published extension from its official Chrome Web Store listing. Chrome manages updates automatically after installation.

Add to Chrome

Local developer installation

  1. Download or clone the project from GitHub.
  2. Open chrome://extensions in Chrome.
  3. Enable Developer mode.
  4. Select Load unpacked.
  5. Choose the project dist directory.
  6. Navigate to a normal http:// or https:// page, open DevTools, and select Auth Flow Inspector.

Install on an offline computer

Prepare the extension package on an internet-connected computer, then transfer it through your organization's approved removable-media or secure file-transfer process.

Prepare the files

  1. Open the GitHub repository.
  2. Select Code, then Download ZIP. A trusted internal administrator can instead clone a reviewed release or commit.
  3. Scan and inspect the downloaded archive according to your organization's software-approval process.
  4. Transfer the archive to the offline computer and extract it to a permanent local directory.
  5. Confirm that the extracted project contains dist/manifest.json.

Load the offline copy

  1. Open chrome://extensions on the offline computer.
  2. Enable Developer mode.
  3. Select Load unpacked.
  4. Select the extracted project dist directory, not the ZIP file or repository root.
  5. Navigate to a normal http:// or https:// page, open DevTools, and select Auth Flow Inspector. Check the DevTools overflow menu if the panel is hidden.
Offline updates are manual An unpacked installation does not receive Chrome Web Store updates. To upgrade, obtain and review a newer project archive, replace the extracted files, then select Reload for the extension on chrome://extensions. Keep the directory in place while the extension is installed.

Managed enterprise environments may disable Developer mode or unpacked extensions. In that case, ask the Chrome administrator to approve and deploy the extension through the organization's managed browser policy. Do not download or install a third-party CRX presented as this project.

Panel visibility and restricted Chrome pages A new tab initially displays chrome://newtab, where Chrome does not allow DevTools extensions to register panels. The panel can also be unavailable on chrome://extensions, Chrome Web Store pages, and other protected browser pages. Navigate to an ordinary website before opening DevTools. If the panel is still not visible, close and reopen DevTools, then check its double-chevron overflow menu.

Capture live traffic

  1. Navigate to the normal application page that will begin the authentication attempt.
  2. Open DevTools before beginning the authentication attempt.
  3. Select Auth Flow Inspector.
  4. Confirm that capture is running.
  5. Perform the login or reproduce the failure in the inspected tab.
  6. Stop capture when the relevant application return or failure is visible.

Start and stop control processing without clearing the existing trace. Use Clear only when you want to begin a separate investigation.

Import HAR or JSON

Use Load Network HAR to read traffic currently available in Chrome's Network panel. Use Import File for a HAR file, a panel JSON export, a raw entry array, or a JSON object containing an entries array.

Opening the panel for offline analysis Even when analyzing a HAR from another system, Chrome still requires the DevTools extension to be hosted by an inspectable tab. Open any ordinary http:// or https:// page, open DevTools, select Auth Flow Inspector, and then choose Import File. The open webpage does not need to match any host in the HAR.
  • Keep request and response headers when exporting a HAR for authentication analysis.
  • Preserve response content when SAML forms, error payloads or token responses are relevant.
  • Treat HAR and full-diagnostic exports as sensitive authentication evidence.

Inspect individual requests

The Traffic Inspector is the selected-request workspace. The request list displays method, HTTP status, duration, content size, protocol tags and a color associated with each host and port.

The detail tabs provide request-level evidence:

  • Request and Response: structured headers, query parameters, forms, bodies and timing.
  • Cookies: request and response cookies with OAM and WebGate-specific highlighting.
  • Kerberos / X.509: browser-visible challenges, authorization schemes and forwarded certificates.
  • SAML XML and SAML Details: decoded messages and organized federation attributes.
  • OAuth Token and OIDC Details: parameters, JWT claims, lifetime and provider evidence.

Use Flow Analysis

Flow Analysis evaluates related requests as a browser-visible transaction. Select Auto, OAM, SAML, WNA or OIDC to review the detected flows for that protocol.

  • The Flow Navigator lists correlated transactions and their request sequence.
  • Selecting flow evidence focuses the corresponding request in the Traffic Inspector.
  • Validation checks distinguish passed evidence, failures and items requiring review.
  • Recommended next actions connect an issue to evidence and a practical troubleshooting step.
  • Expandable protocol details retain OAM and WNA-specific context without duplicating request tabs.

Export evidence and assessments

Traffic export

Export the captured entries as JSON for repeatable offline analysis. Use the sanitized option when the trace will leave the controlled troubleshooting team.

Assessment export

  • Markdown Report - Sanitized: redacts sensitive values while retaining analysis, timeline and next actions.
  • Markdown Report - Full Diagnostic: retains correlation values needed for controlled server-side log investigation.

Browser-visible scope and limits

The inspector does not claim visibility into exchanges that never reach Chrome DevTools.

  • Server-to-server token exchanges and federation calls may be absent.
  • Kerberos ticket caches, KDC traffic and PAC data are not decrypted or validated.
  • Backend OAM, WebGate, application and identity-provider logs remain separate evidence sources.
  • JWT, SAML and certificate material is decoded and summarized; cryptographic trust is not validated.

When an ECID, request ID, trace ID or provider correlation ID is visible, preserve it and use it to locate the corresponding server-side event.