Introducing the ClavionX SAML Debugger: SSO evidence anyone can capture and share
A free browser extension that makes SAML failures easy to capture, understand, and share — built for the people who have to send the support ticket, not just the engineers who read it.
When enterprise SSO breaks, the person staring at the failed login is almost never a SAML engineer. It's a customer's IT admin, or a support agent, or an account manager relaying screenshots between two companies. And the first thing support asks for is the thing they can least easily provide: "Can you capture a SAML trace and send it to us?"
What follows is a ritual everyone in this industry knows. Install a tracer extension. Reproduce the failure. Find the export button. Work out which of the forty entries matter. Email a file that — nobody quite wants to think about this part — contains live session cookies and personal attribute values. Three days and four time zones later, an engineer finally opens it and starts the actual analysis. The evidence was sitting in the browser the whole time; the loop is what costs the week.
We built the ClavionX SAML Debugger to collapse that loop.
Built for the person who has to send the details
The debugger is a free browser extension that captures SAML traffic locally and turns it into something any participant in the support chain can use:
- One-click capture, already organized. AuthnRequests, SAMLResponses, and logout messages are correlated into complete flows using SAML's own identifiers — request ID and InResponseTo, RelayState, SessionIndex. No hunting through a flat request list for the entries that matter.
- Readable by non-specialists. Each message is presented in structured sections — General, Security, Conditions, Authentication, Attributes — with the raw XML demoted to a secondary tab. You don't decode base64 to see what happened.
- A report that's safe to share, by construction. One click produces a plain-text or Markdown summary you can paste straight into Jira, ServiceNow, Slack, or an email to the other side's identity team. NameIDs, attribute values, and cookie values are never included — so the person sharing it doesn't need to know what would have been dangerous to forward.
That last point is the heart of it. Support artifacts are usually produced by the least technical person in the chain and consumed by the most technical one. Every existing tool is designed for the consumer. This one is designed for both.
An analysis assistant — honestly scoped
The debugger also analyzes what it captures. Each flow runs through a deterministic knowledge base of real-world SAML failure modes — correlation mismatches, signature and algorithm problems, timing windows, session and cookie issues — and produces an evidence trail you can expand check by check, a likely-fault breakdown across identity provider, service provider, browser, and network, and a confidence score. When the capture can't support a conclusion, it says Unable to Determine and tells you what to recapture. It never guesses.
And here's the honest boundary, stated plainly because troubleshooting tools that oversell are worse than none: a browser extension sees the browser's half of the conversation. The deepest SAML failures — signature validation internals, attribute mapping logic, certificate chains, server-side clock state — live in IdP and SP server logs that no client-side tool can reach. The debugger's job is to make sure the investigation starts with organized evidence and a probable direction instead of screenshots and blame — and to hand the server-side team a report worth opening. Detection will keep improving with every release, but we won't pretend a browser trace replaces server-side diagnosis. It's the first mile of the investigation, done properly.
Everything stays in your browser
A tool that captures authentication traffic has to earn trust before it earns installs. The extension runs entirely locally: captured flows are stored in your browser, analysis happens in your browser, and nothing is transmitted anywhere — no telemetry, no analytics, no phone-home. The only way data leaves is when you explicitly copy a sanitized summary to your clipboard. The full privacy policy is at samldebugger.clavionx.com.
Why we built it
ClavionX speaks SAML in both directions — as a service provider federating with enterprise IdPs, and as an identity provider for downstream applications. Building and testing that meant living inside broken SAML flows for months, and living inside the support loop around them: the requests for traces, the redacting, the back-and-forth. The debugger started as our own internal tooling and evolved, honestly, away from its original ambition — we thought it would be a root-cause oracle, and it became something more useful: the tool that makes the whole support chain faster, with a triage engine that knows the limits of its evidence. Every engineer and every support team that touches enterprise SSO has this problem, whether or not they ever use our platform. So it's free, for everyone.
Get it
Available now:
What's next
On the roadmap: full sanitized JSON export and import so two teams can work from the same capture, a dedicated cookie inspection panel, search across captured flows, vendor-specific guidance for the common IdPs — and steadily better detection, within the limits a browser's view honestly allows. If the debugger shortens your support loop — or fails to — we want to hear about it: [email protected].
