OneLogin - How to collect a SAML trace using SAML-tracer (4383021)

A SAML or WS-Federation sign-in issue requires a browser-based SAML trace for troubleshooting. A SAML trace records the browser requests involved in the authentication flow and highlights SAML or WS-Federation messages so the encoded request or response can be reviewed. 

SAML and WS-Federation authentication issues often require inspection of the request, response, parameters, and decoded SAML message exchanged between the browser, identity provider, and service provider. The SAML-tracer browser extension is designed to capture and decode these messages during the sign-in flow. 

Use the SAML-tracer browser extension to capture the authentication flow.

1. Install the SAML-tracer browser extension from the browser extension store.

• • Firefox extension: https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/
  • Chrome extension: https://chromewebstore.google.com/detail/saml-tracer/mpdajninpobndbfcldcmbpnnbhibjmch
  • The extension is available for Firefox and Chrome-based browsers.

2. Open the browser and go to the page where the sign-in or authentication issue occurs.
3. Start SAML-tracer by selecting its icon in the browser toolbar.

• • Alternatively, press Alt + Shift + S.

4. With the SAML-tracer window open, reproduce the sign-in or authentication issue.
5. Review the request list in SAML-tracer.

• • Requests containing SAML data are highlighted with a SAML logo.
  • Requests containing WS-Federation data are highlighted with a WS-Fed logo.

6. Select the relevant request and review the available tabs:

• • HTTP: Request and response header overview.
  • Parameters: GET and POST parameters included in the request.
  • SAML: Decoded SAML message found in the request.

7. Export the trace from SAML-tracer.

• • In Chrome-based browsers, open SAML-tracer > Export.
  • For Select cookie-filter profile, select None.
  • Click Export.

8. Save the exported trace file and provide it through the approved support channel.