Version 5.1.1

Documentation

Enterprise Authentication & NetLog Inspector is a Manifest V3 DevTools extension for Google Chrome and Microsoft Edge that investigates browser-visible authentication, SSO, federation and authorization traffic.

New to the extension? Follow the step-by-step Getting Started walkthrough for a complete capture, inspection, Flow Analysis, and report-export workflow. When investigating a failure, use the protocol-specific troubleshooting tutorials.

Install from the Chrome Web Store

Install the published extension from its official Chrome Web Store listing. Chrome manages updates automatically after installation.

Add to Chrome

Install in Microsoft Edge

The Edge package uses the same analyzer and an Edge-specific profile for DevTools labels, edge://net-export guidance, and future Microsoft Edge Add-ons linking.

Download or clone the project from GitHub.
Run npm run build:edge from the repository root, or use a reviewed release that already contains dist-edge.
Open edge://extensions in Microsoft Edge.
Enable Developer mode and select Load unpacked.
Choose the project dist-edge directory.
Navigate to an ordinary HTTP(S) page, open Microsoft Edge DevTools, and select Auth & NetLog Inspector from the Activity Bar or More tools.

Microsoft Edge Add-ons status The Edge-compatible package is ready for Partner Center submission. A public Add-ons link will be added here after Microsoft approves and publishes the listing.

Local developer installation

Download or clone the project from GitHub.
Open chrome://extensions in Chrome.
Enable Developer mode.
Select Load unpacked.
Choose the project dist directory.
Navigate to a normal http:// or https:// page, open DevTools, and select Auth & NetLog Inspector.

Install on an offline computer

Prepare the extension package on an internet-connected computer, then transfer it through your organization's approved removable-media or secure file-transfer process.

Prepare the files

Open the GitHub repository.
Select Code, then Download ZIP. A trusted internal administrator can instead clone a reviewed release or commit.
Scan and inspect the downloaded archive according to your organization's software-approval process.
Transfer the archive to the offline computer and extract it to a permanent local directory.
Confirm that the extracted project contains dist/manifest.json.

Load the offline copy

Open chrome://extensions on the offline computer.
Enable Developer mode.
Select Load unpacked.
Select the extracted project dist directory, not the ZIP file or repository root.
Navigate to a normal http:// or https:// page, open DevTools, and select Auth & NetLog Inspector. Check the DevTools overflow menu if the panel is hidden.

Offline updates are manual An unpacked installation does not receive Chrome Web Store updates. To upgrade, obtain and review a newer project archive, replace the extracted files, then select Reload for the extension on chrome://extensions. Keep the directory in place while the extension is installed.

Managed enterprise environments may disable Developer mode or unpacked extensions. In that case, ask the Chrome administrator to approve and deploy the extension through the organization's managed browser policy. Do not download or install a third-party CRX presented as this project.

Panel visibility and restricted Chrome pages A new tab initially displays chrome://newtab, where Chrome does not allow DevTools extensions to register panels. The panel can also be unavailable on chrome://extensions, Chrome Web Store pages, and other protected browser pages. Navigate to an ordinary website before opening DevTools. If the panel is still not visible, close and reopen DevTools, then check its double-chevron overflow menu.

Open the Offline Viewer

Select the extension's toolbar icon to open a separate file-analysis workspace in a normal browser tab. The viewer does not require DevTools, an inspectable website, or access to the current page. Choose Import File or drop a HAR, Inspector JSON export, Firefox SAML-tracer JSON export, or Chromium NetLog JSON file onto the viewer. Choose System, Light, or Dark from the viewer's Theme menu; the selection is remembered locally. All analysis remains local.

Saved evidence only Offline Viewer does not capture live requests and therefore omits Start/Stop capture, Load Network HAR, and inspected-page actions. Use the DevTools panel when recording a new login attempt.

Capture live traffic

Navigate to the normal application page that will begin the authentication attempt.
Open DevTools before beginning the authentication attempt.
Select Auth & NetLog Inspector.
For a wider workspace, use the DevTools three-dot menu > Dock side > Undock into separate window. You can also press Command + Shift + D on macOS or Ctrl + Shift + D on Windows/Linux.
Confirm that capture is running.
Perform the login or reproduce the failure in the inspected tab.
Stop capture when the relevant application return or failure is visible.

Start and stop control processing without clearing the existing trace. Use Clear only when you want to begin a separate investigation.

Undocking does not change the capture target The separate DevTools window still inspects the browser tab where DevTools was opened. Keep both that application tab and the DevTools window open throughout the authentication attempt.

Import HAR, SAML-tracer JSON, or Chromium NetLog

Use Load Network HAR to read traffic currently available in Chrome's Network panel. Use Import File for a HAR file, a panel JSON export, a Firefox SAML-tracer JSON export, a raw entry array, or a JSON object containing an entries array. For SAML-tracer exports, the inspector retains decoded SAML XML supplied by the source file even when its form value was redacted. The same command recognizes Chromium NetLog JSON dumps and opens them in the dedicated NetLog Analysis workspace.

Recommended offline workflow Select the extension toolbar icon and import the file in Offline Viewer. You may still import the same file from the DevTools panel when comparing it with live traffic, but that panel requires an ordinary http:// or https:// page.

Keep request and response headers when exporting a HAR for authentication analysis.
Preserve response content when SAML forms, error payloads or token responses are relevant.
Treat HAR, NetLog, and full-diagnostic exports as sensitive authentication evidence.

Capture and inspect a Chromium NetLog

Open chrome://net-export in Chrome or edge://net-export in Microsoft Edge and choose Start Logging to Disk.
Reproduce one authentication or connection problem, return to the Net Export page, and stop logging.
Open any ordinary HTTP(S) page, open DevTools, and select Auth & NetLog Inspector.
Choose Import File and select the saved NetLog JSON file.
Open NetLog Analysis. Start with Issues, then inspect Auth, DNS, Proxy, TLS, Sockets, HTTP/2, or QUIC.
Select a source to isolate its timeline and expand an event to inspect all raw parameters.
For an authentication challenge or retry finding, choose Trace exchange. Review the server challenge, browser response, retry/continuation, and final outcome, then use Previous or Next to move between challenges.
For a TLS finding, choose Trace TLS connection. Review endpoint setup, handshake evidence, certificate validation, TLS/ALPN negotiation, connection reuse, transport fallback, and the final outcome.
For every other finding, choose its Investigate action to isolate the triggering event, linked sources, related evidence categories, final visible outcome, and category-specific next step.

Contextual finding actions

Finding	Contextual action	Primary troubleshooting question
Auth	Trace exchange	Did the browser answer the challenge with Kerberos, NTLM, another scheme, or no conclusive token, and what was the final response?
TLS	Trace TLS connection	Did endpoint setup, handshake, certificate validation, protocol negotiation, or connection reuse fail?
DNS	Investigate DNS	Which hostname failed, what resolver path was used, and did VPN or split DNS affect the result?
Proxy	Investigate Proxy	Which PAC, bypass, proxy, authentication, or fallback decision controlled the route?
Socket	Investigate Socket	Was the selected address reached, refused, reset, timed out, or cancelled?
HTTP	Investigate HTTP	Which URL request, redirect, headers, stream event, or response status ended the operation?
HTTP/2	Investigate HTTP/2	Did the session or stream fail, and which socket and URL request were affected?
QUIC	Investigate QUIC	Did QUIC fail or retry, and did Chromium successfully fall back to TCP/TLS?
Other	Investigate Other	Which linked source and raw parameters connect the event to the originating request?

The generic investigation view deliberately does not invent a protocol stage model. It narrows the timeline to explicit source dependencies and nearby issue evidence, highlights the root event, and presents a category-specific next action. Use Previous and Next to compare repeated findings in the same category.

Authentication tracing follows explicit Chromium source dependencies where available and nearby authentication and HTTP evidence otherwise. When Chromium exposes a client token in nested headers or authentication fields, the inspector decodes it locally and checks for NTLMSSP, Kerberos mechanism OID, and AP-REQ evidence without displaying the token. The trace distinguishes confirmed Kerberos, confirmed NTLM fallback, inconclusive SPNEGO/Negotiate, challenge-only, and redacted or missing-token evidence, then recommends the next client, SPN/DNS, identity, or server-side check. Always verify summarized stages against expanded raw events and authoritative logs.

TLS tracing reports version, cipher, key-exchange group, ALPN, certificate status, and reuse only when Chromium exposes the corresponding NetLog fields. A missing field is reported as Not captured and is not treated as proof that validation or negotiation succeeded.

Focused analysis, not the full Chromium viewer The extension prioritizes authentication and connection troubleshooting. Chromium does not guarantee backwards-compatible NetLog schemas, so unknown event types are retained as raw evidence and some browser-version-specific fields may not receive a specialized interpretation. Diagnostic counts represent matching NetLog events rather than a guaranteed count of user-visible failures; retries, speculative connections, and secondary cancellations can produce multiple related events.

Inspect individual requests

The Traffic Inspector is the selected-request workspace. The request list displays method, HTTP status, duration, content size, protocol tags and a color associated with each host and port.

The detail tabs provide request-level evidence:

Request and Response: structured headers, query parameters, forms, bodies and timing.
Cookies: request and response cookies with OAM and WebGate-specific highlighting.
Kerberos / X.509: browser-visible challenges, client-token classification using NTLMSSP, Kerberos OID, or AP-REQ evidence, authorization schemes, and forwarded certificates.
SAML XML and SAML Details: decoded messages and organized federation attributes.
OAuth Token and OIDC Details: parameters, JWT claims, lifetime and provider evidence.

Use Flow Analysis

Flow Analysis evaluates related requests as a browser-visible transaction. Select Auto, OAM, SAML, WNA or OIDC to review the detected flows for that protocol.

The Flow Navigator lists correlated transactions and their request sequence.
Selecting flow evidence focuses the corresponding request in the Traffic Inspector.
Validation checks distinguish passed evidence, failures and items requiring review.
Recommended next actions connect an issue to evidence and a practical troubleshooting step.
Expandable protocol details retain OAM and WNA-specific context without duplicating request tabs.

Export evidence and assessments

Traffic export

Export the captured entries as JSON for repeatable offline analysis. Use the sanitized option when the trace will leave the controlled troubleshooting team.

Assessment export

Markdown Report - Sanitized: redacts sensitive values while retaining analysis, timeline and next actions.
Markdown Report - Full Diagnostic: retains correlation values needed for controlled server-side log investigation.

Browser-visible scope and limits

The inspector does not claim visibility into exchanges that never reach Chrome DevTools.

Server-to-server token exchanges and federation calls may be absent.
Token classification does not decrypt credentials or validate trust. Kerberos ticket caches, KDC traffic, session keys, and PAC data remain outside browser visibility.
Backend OAM, WebGate, application and identity-provider logs remain separate evidence sources.
JWT, SAML and certificate material is decoded and summarized; cryptographic trust is not validated.

When an ECID, request ID, trace ID or provider correlation ID is visible, preserve it and use it to locate the corresponding server-side event.