How to Perform a SAML Trace | Axero Documentation

A SAML trace is a record of the Security Assertion Markup Language (SAML) transactions that occur during the authentication process between an Identity Provider (IdP) and a Service Provider (SP). 

Performing a SAML trace is useful for troubleshooting SAML issues, as it allows you to view the complete exchange of SAML transactions and identify any errors or missing information in the SAML assertions. It is essential for diagnosing and resolving problems related to single sign-on (SSO) and identity federation

Due to the sensitive nature of the data that could be contained in a SAML Trace; we follow strict guidelines in handling files provided. Please:

• Only share SAML Traces as an attachment in a Support Case upon request. Your case assigned TSE will migrate the Trace to a secure platform and delete the attachment, noting the secure location of the file in a case comment.
  • Alternatively, if you have a secure sharing platform you prefer to use that we could access; you may save the file there and provide us detailed instructions on how to access
  • Never share a SAML Trace over email
• Upon case closure; Axero will delete any SAML Trace that was provided as a troubleshooting step, and confirm in their Closing comment. If you do not receive this confirmation; please prompt our team.

To perform a SAML trace, you can use browser extensions. Below are two potential options for you to consider, however these are 3rd Party Extensions so please follow your company guidelines prior to downloading or installing either. Here are the steps to perform a SAML trace:

1. Install the SAML Tracer extension for your browser:

• • For Google Chrome or Microsoft Edge, visit https://chrome.google.com/webstore/detail/saml-tracer/mpdajninpobndbfcldcmbpnnbhibjmch 
  • For Mozilla Firefox, visit https://addons.mozilla.org/en-US/firefox/addon/saml-tracer 

2. Open the SAML Tracer window by clicking the newly added SAML Tracer icon in the extensions area, usually located in the top right corner of the browser.

3. Perform the login or logout operation that you want to trace.

4. The SAML Tracer window will record the details of the transaction, including the SAML transactions (shown with occasional orange SAML tags) that indicate an authentication process is occurring.

5. Export the SAML trace by clicking on the "Export" button on the top menu bar of the SAML Tracer window.
   
   

6. When prompted for a cookie-filter profile, select “Mask values” and click Export.
   
   

7. Share the downloaded JSON file with Axero Support for further analysis or troubleshooting.