AuthTrace › Guides

How to capture a SAML trace or HAR file, and send it safely

When single sign-on breaks, the identity provider's or the application's support team nearly always asks for the same thing: "send us a SAML trace" or "attach a HAR file of the sign-in". Both are recordings of the browser traffic during the sign-in. Recording one takes two minutes. Most of the work is getting the whole flow in the file and keeping live credentials out of it.

Before you start

Use a private window. If you are already signed in to the identity provider, it skips steps and the trace shows only the end of the flow. A private (Incognito or InPrivate) window starts with no session, so the trace covers the whole flow, including the sign-in prompt.
Open DevTools first, then start the sign-in. Browsers only record traffic while DevTools is open. Requests made before you opened it are not in the recording.
Start from the application (SP-initiated) unless support asked you to start from the identity provider's app portal. That way the trace also holds the request the app sent, which you need to diagnose an InResponseTo mismatch or an unregistered reply URL.

Chrome and Edge: record a HAR file

Open a private window and press F12 (Cmd+Opt+I on a Mac). Select the Network tab.
Tick Preserve log. Without it the log is cleared each time the browser moves to the identity provider and back, and you lose the messages you need.
Go to the application and sign in until the error appears. Don't close the tab.
Click the Export HAR button (the downward arrow in the Network toolbar) and save the file.

Recent Chrome versions leave Cookie, Set-Cookie and Authorization headers out of the exported HAR by default. That helps, but the sign-in messages themselves stay in the file: the SAMLResponse form field, authorization codes in URLs, and the tokens in token endpoint responses.

Firefox: record a HAR file

Open a private window, press F12 and select the Network tab.
Open the network settings menu (the gear at the right of the toolbar) and turn on Persist Logs.
Sign in until the error appears.
In the same settings menu, choose Save All As HAR.

What a trace gives away

A trace of a sign-in is a recording of someone handing over their credentials. Before you attach it to a ticket, know what is inside:

In the file	Why it matters
`SAMLResponse`	A signed assertion of who the user is. Anyone who has it can replay it to the application until it expires (`NotOnOrAfter`, often five minutes to an hour), unless the app rejects reused assertions. It also holds names, email addresses and group memberships.
`id_token`, `access_token`, `refresh_token`	Bearer tokens. An access token works for anyone holding it until it expires; a refresh token can mint new ones for days or months.
Authorization `code`	Single use and short lived, but still a credential until redeemed.
Form posts to the sign-in page	Usernames and, depending on the provider, typed passwords or one-time codes.
Cookies and session IDs	Session cookies can sign someone in as the user. Chrome now drops them from exports by default; Firefox and older Chrome versions don't.
Everything else on the page	A HAR records every request in the tab: other sites, internal hostnames, analytics calls, IP addresses.

If you must send a raw file, record it with a test account, send it through the vendor's support portal rather than email or a shared chat channel, and reset the account's sessions afterwards (in most identity providers: revoke sessions or sign out everywhere).

Send a redacted trace instead

AuthTrace is a free DevTools panel that records the same traffic and decodes it as it happens. Two things change the conversation with support:

Read it yourself first. The panel names the usual causes in plain words, such as an audience mismatch, an expired assertion, a wrong ACS URL or an unregistered redirect URI, and says what to change. Often the ticket never needs to be opened. This part is free.
Export a redacted copy (Pro). AuthTrace Pro exports a HAR or a one-file HTML report with token signatures and secrets removed, cookies stripped, emails, names and user IDs masked consistently (so support can still see that two values match), and traffic outside the sign-in flow dropped. The support team gets every value they need to diagnose the problem and nothing that signs anyone in.

Received a HAR or a SAML-tracer export from a user? Import it into AuthTrace (free) and it is decoded and checked the same way as a live capture, without uploading it anywhere.

Checklist before you press send

The trace starts at the application, before the redirect to the identity provider.
It ends with the error, after the response was posted back to the application.
It contains one sign-in attempt, not several. Clear the log and retry if in doubt.
You noted the time of the attempt (with time zone) and the user it was for, so support can match it to their logs.
Live tokens and assertions are redacted, or the account's sessions have been revoked.

More guides

SAML