Read the protocol flow diagram#
A swimlane diagram puts a SAML, OAuth, or Kerberos credential back into the exchange that produced it, labelled with your own values.
A credential is one message out of an exchange between several parties. The flow diagram puts the credential you pasted back into that exchange. You see which step produced it, and what was meant to happen on either side.
SAML, OAuth, and Kerberos each get a flow tab. Auth Inspector draws the diagram as swimlanes, one column per participant. Each step sits in the lane of the participant that performs it.
Values taken from your credential#
The lanes take their labels from the credential rather than from placeholders. A SAML response names the service provider under its audience host and the identity provider under its issuer host. An OAuth flow shows the client identifier under the client lane. Kerberos shows the realm and principal.
Individual steps pick up detail from the decoded data too. The authentication step in a SAML flow names the authentication method that was used. The PKCE step in an OAuth flow names the challenge method.
Select a flow variant#
One credential can belong to more than one exchange. Each flow tab has a dropdown, so you can choose which exchange to draw.
| Protocol | Control | Variants |
|---|---|---|
| SAML | Flow Type | SP-Initiated SSO, IdP-Initiated SSO |
| OAuth | Flow | Authorization Code + PKCE, Client Credentials, Implicit (Deprecated), Device Code |
| Kerberos | Flow | Full Authentication, AS Exchange, TGS Exchange, AP Exchange |
The default is the common case: service-provider-initiated for SAML, authorisation code with PKCE for OAuth, and the full exchange for Kerberos.
The Kerberos variants help you narrow down a problem. Full Authentication shows the whole path, from the initial login to the request to a service. The three individual exchanges isolate one leg each, so you can concentrate on the part that fails.
Note The variant you pick for OAuth is remembered as you move between modes. The SAML and Kerberos selections reset to the default when you leave the tab.
JWTs and certificates have no flow tab. A JWT does not belong to one exchange, so it gets a timeline instead. A certificate gets a chain graph.