SAML Tracer is a browser extension used to inspect SAML authentication messages during single sign-on flows. It captures and decodes SAML requests and responses so analysts can troubleshoot login failures, verify assertions, and check identity claims, relay states, and signature handling in federated IAM environments.
How SAML Tracer Works
saml Tracer is a browser-side inspection tool for SAML exchanges. It lets practitioners see the raw authentication messages that move between the identity provider and service provider, which is useful when a login flow fails or when an assertion does not behave as expected.
The value of the tool is that it makes otherwise opaque federation traffic visible. In practice, that means you can examine the request, the response, and the fields that determine whether a federated sign-in succeeds, including relay state handling and assertion content.
What Analysts Use It to Verify
Teams typically use SAML Tracer to confirm that the SSO transaction contains the claims and routing data the application expects. That includes checking whether attributes are present, whether the assertion is encoded and signed as intended, and whether the browser is carrying the correct state through the redirect chain.
It is also useful for comparing what the identity provider issues against what the relying application actually consumes. That gap is a common source of troubleshooting work in federation, especially when an application maps SAML attributes incorrectly or rejects an otherwise valid response.
Why SAML Message Inspection Matters
SAML is powerful because it can centralize authentication across many applications, but the same complexity makes failures hard to diagnose without visibility into the protocol. A browser extension that decodes SAML traffic shortens the path from symptom to root cause by exposing the exact payloads involved in the SSO exchange.
That visibility also helps distinguish between application defects, identity-provider misconfiguration, and user-side browser issues. When the tool shows the message sequence clearly, analysts can tell whether the failure is happening before the assertion is issued, during transport, or at the point where the service provider evaluates the response.
Common Troubleshooting Scenarios
SAML Tracer is most useful when an organisation needs to understand why federated login failed without guessing. A browser view of the transaction can reveal malformed requests, missing assertions, incorrect audience values, unexpected relay state changes, or signature handling problems that would otherwise be hidden inside a generic “access denied” error.
It is equally helpful during change validation. After federation updates, certificate changes, or attribute mapping changes, analysts can compare the captured messages against the expected flow and confirm that the SSO path still behaves correctly.
Risk and Threat Considerations
SAML message inspection is a defensive activity, but it operates on highly sensitive authentication data. Captured assertions, relay state values, and identity claims can expose trust relationships and session-related details, so the tool should be used carefully on controlled endpoints and in accordance with organisational policy.
Failure mechanism: If SAML handling is weak, attackers may exploit forged responses, signature confusion, replay, or assertion tampering to impersonate users or bypass federation controls. Visibility into the transaction helps defenders spot those patterns before they are mistaken for ordinary login failures.
Impact: A compromised or misvalidated SAML flow can lead to unauthorized access, privilege misuse, and exposure of accounts that rely on SSO for central trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while OWASP ASVS, NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V10 — OAuth and OIDC | SAML Tracer inspects federated sign-in flows that are often compared with OIDC SSO patterns. |
| Recommendation — Use V10 to validate federation and token-handling expectations when comparing SAML and OIDC sign-in behaviour. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | SAML Tracer is used to verify how users are authenticated through federated SSO flows. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Tracing SAML exchanges supports investigation and analysis of authentication events. | |
| Recommendation — Review IA-2 controls to confirm that federated authentication is implemented and evaluated correctly. Use AU-6 to correlate federation events with logs when troubleshooting sign-in failures or suspicious activity. | ||
| NIST SP 800-63 | Digital Identity Guidelines | SAML Tracer is used in identity federation contexts governed by digital identity assurance concepts. |
| Recommendation — Align federation testing with assurance and authentication expectations defined by digital identity guidance. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | SAML assertions are authentication material, and inspection helps identify broken or mishandled authentication flows. |
| Recommendation — Test federation flows for broken authentication paths when SAML assertions are accepted or rejected incorrectly. | ||
Related resources from NHI Mgmt Group
- Guide: Workforce Identity Security Guide
- Why are Golden SAML attacks so difficult to detect?
- Should organisations move from SAML to OIDC for modern application authentication?
- What is the main difference between SAML and OIDC for IAM teams?
- Why does certificate rotation create more risk in SAML environments?