Sources.
“Zero trust.” “Enterprise-grade.” “Military-grade encryption.” – security tools promise a lot and prove little. For a tool that checks every parameter of a login, that would be embarrassing. So every claim on this website has a source: product claims with our documentation as of version 1.0.0 of 8 November 2026, books and vendor with link and date.
All siblings of the Tailor family share the habit. For us it means: no signature left unchecked1, no claim without evidence.
Product
Version 1.0.0 of 8 November 2026
First release as a stand-alone extension. Version 1.0.0 brings the five tabs Auth Trace, Tools, SAP, Learning and About, the privacy policy in the panel and the link to the CloudDNA imprint.
AuthTailor product documentation, changelog 1.0.0 · checked on 2026-11-08
Browser extension for Chrome, with builds for Edge and Firefox
One codebase for Chrome and Edge (Manifest V3, side panel) and Firefox (sidebar). The build produces packages for the Chrome Web Store, Microsoft Edge Add-ons and Firefox Add-ons. User interface in English (default) and German.
AuthTailor product documentation, README and build configuration · checked on 2026-11-08
Free, no account and no licence
AuthTailor is the SAML & OIDC tracer from iFlowTailor as a stand-alone plug-in – not tied to SAP, no account, no licence. There are no paid features and no sign-in inside the extension.
AuthTailor product documentation, README · checked on 2026-11-08
The tracer from iFlowTailor
Analysis, recording and user interface come from iFlowTailor, CloudDNA’s workbench for SAP Cloud Integration. The tracer still lives there; changes are carried over to both products.
AuthTailor product documentation, README, section “Origin of the code” · checked on 2026-11-08
Five tabs
Auth Trace (record or paste, check, rate), Tools, SAP, Learning and About. In a narrow panel the tab icons are dropped so that all five fit.
AuthTailor product documentation, README and changelog 1.0.0 · checked on 2026-11-08
Screenshots and video with made-up data
The live recording in the pictures and the video is an entirely made-up sign-in to “Acme Orders” (*.acme.example, OpenID Connect with PKCE, followed by an API call). The token is signed with a throw-away key that only existed during the recording. SAML, SAP, Tools and Learning show the built-in examples. No real recording, no real names, tenants or tokens.
AuthTailor product documentation, Chrome Web Store materials · checked on 2026-11-08
Record live in any tab
Press “Record live” and sign in in any tab: the tracer shows the flow browser → app → identity provider as a diagram and checks state, nonce, PKCE, redirect_uri, InResponseTo, ACS URL and RelayState across the whole flow.
AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
Paste or drop
SAML Response, AuthnRequest, Assertion, metadata (XML, Base64, redirect-deflate), JWT, login URL, token request and response, discovery, JWKS, HAR file or an error message – known error codes, for example from Entra ID, SAP Cloud Identity Services, XSUAA and SuccessFactors, with cause and fix.
AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
Visual anatomy of JWT and SAML
JWT taken apart into header, payload and signature, chain of trust issuer → signature → audience, ID card with scopes and roles, times relative to now with clock-skew tolerance; SAML building blocks nested as in the XML, with seal and finding colour.
AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
Signatures really checked
SAML cryptographically with the certificate from the message – our own XML canonicalisation (exclusive and inclusive, tested against libxml2), RSA, RSA-PSS and ECDSA with SHA-1 to SHA-512 – optionally matched against the SHA-256 fingerprint from the IdP metadata. JWTs with the issuer’s keys, fetched by a click on “Load keys from …”. Warns about expiring certificates and keys missing after a rollover.
AuthTailor product documentation, README and changelog 1.0.0 · checked on 2026-11-08
Traffic light in five areas
Security rating per area: flow & protocol, tokens & signatures, transport & leaks, cookies & session, browser protection. Purely functional findings such as a wrong audience or an expired token do not count towards the security rating.
AuthTailor product documentation, changelog 1.0.0, security check · checked on 2026-11-08
Attack patterns and leaks
SAML: signature wrapping, duplicate IDs, comment in the NameID, DTD (never resolved), XSLT and XPath transforms (never executed). JWT: jku, x5u and jwk in the header, kid injection, crit. Leaks: code or token in the Referer to third parties, tokens in the query, client secret sent from the browser, token response without Cache-Control: no-store. Plus session fixation, third-party scripts without SRI on login pages, open redirects, look-alike and punycode hosts.
AuthTailor product documentation, README and changelog 1.0.0 · checked on 2026-11-08
Headers per step, masked
Request and response headers per step, masked, with a SameSite check of the cookies on the POST back to the app; HSTS, frame protection and Referrer-Policy of the login pages; HttpOnly, Secure and the __Host- prefix of the session cookies.
AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
Bearer tokens and DPoP (option)
With the “Also bearer tokens” option the tracer shows JWTs from the Authorization header of API calls, with the rejection reason from WWW-Authenticate; DPoP proofs are checked against method, URL, ath and cnf.jkt. Refresh tokens: rotation and reuse.
AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
Logout, discovery and metadata
OIDC and SAML logout: whether the session cookies were deleted and the IdP signed out. Discovery and SAML metadata rated: implicit and password grant, none, PAR, DPoP, mTLS, logout endpoints; WantAssertionsSigned, SHA-1, transient NameID.
AuthTailor product documentation, changelog 1.0.0 · checked on 2026-11-08
Markdown report, masked
The report summarises verdict, rating, flows, findings and steps as Markdown, ready for a ticket. It contains masked values only.
AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
Tools: passkeys, certificates, web security
Detects what was pasted: passkey response (WebAuthn: flags, authenticator, synced or device-bound, origin, RP ID, challenge), certificates, chains, CSRs, public and private keys, JWK and JWKS (order, expiry, key size, SHA-1, host name, whether key and certificate belong together), Content Security Policy with a stricter suggestion, security headers, CORS preflight, suspicious login links (punycode, look-alikes, open redirects) and secrets in any text.
AuthTailor product documentation, README and changelog 1.0.0, Tools · checked on 2026-11-08
Clean a HAR file
Masks cookies, Authorization and session headers, codes, tokens, passwords and secret parameters in URL, form and JSON; JWTs stay readable but lose their signature. Response bodies: JSON only, none or all; SAML kept on request. Saved as a .sanitized.har file.
AuthTailor product documentation, changelog 1.0.0, Tools · checked on 2026-11-08
Find tokens in page storage – without the value
On click, a function runs once in the active tab and searches localStorage, sessionStorage, IndexedDB and the names of cookies readable by JavaScript. Only the kind, length and harmless claims of the tokens (issuer, audience, expiry, scopes) come back, never a value. No content script; access via activeTab or a one-time grant that is handed back afterwards.
AuthTailor product documentation, README, permissions; changelog 1.0.0 · checked on 2026-11-08
SAP BTP: tokens, configuration, flows
XSUAA and IAS tokens (scopes per app, role collections, zone, grant), reviews of xs-security.json, xs-app.json, service keys and destinations (JSON or properties, secrets masked only), logon tickets (MYSAPSSO2) with signature check, BTP flows (app router → XSUAA → IAS, IAS directly, principal propagation, SAML bearer, CSRF) as diagrams, SAP basics and SAP Gateway and ICF errors with cause and fix.
AuthTailor product documentation, README and changelog 1.0.0, SAP · checked on 2026-11-08
“Why 403?”
Paste the token and enter the expected scopes or roles: the view compares, scope by scope, what the token carries with what the app requires, and names what is missing.
AuthTailor product documentation, changelog 1.0.0, SAP · checked on 2026-11-08
13 flows, eight chapters, glossary, error catalogue, checklist
13 flows of OAuth 2.0, OpenID Connect and SAML as sequence diagrams to click through and play (code + PKCE, BFF, client credentials, refresh, device code, on-behalf-of, DPoP, implicit, password grant, SAML SP- and IdP-initiated, SAML bearer, logout), with risks and what the tracer checks. Plus basics in eight chapters, a glossary, a catalogue of known error messages with cause and fix and a go-live checklist. Flows detected in your input lead straight to the explanation.
AuthTailor product documentation, README and changelog 1.0.0, Learning · checked on 2026-11-08
No server, no telemetry
AuthTailor has no server, no account, no analytics, no telemetry, no advertising and no third-party code. The extension sends no data, neither to CloudDNA nor to anyone else. The analysis runs entirely in the panel on the device.
AuthTailor product documentation, privacy policy of the extension, “In short” · checked on 2026-11-08
The one request: public keys on click
Only on a click on “Load keys from <issuer>” does the panel fetch the issuer’s public discovery document and public keys (JWKS) with an HTTP GET without cookies or referrer. Nothing from the input is sent. Without that click, the extension makes no network request.
AuthTailor product documentation, privacy policy of the extension · checked on 2026-11-08
In memory only, while the panel is open
Recordings and pasted content – including service keys, destinations and configurations – stay in memory only while the panel is open; they are never written to disk. Only the UI language, the “Headers” option and a flag in session storage recording whether the extension requested the host permission itself are stored.
AuthTailor product documentation, privacy policy of the extension · checked on 2026-11-08
Masked as it is recorded
Cookie values, Authorization values, CSRF tokens, API keys, session headers, client secrets and passwords are masked while recording. Long cookie values are kept only as a short fingerprint so that the tracer can tell a renewed session; refresh tokens only as a short hash so that it can tell their rotation. Whatever leaves the panel is copied or saved by the user – and contains masked values only.
AuthTailor product documentation, privacy policy of the extension, masking · checked on 2026-11-08
Permissions and host access
Fixed in the manifest: storage (language and “Headers” option), sidePanel, webRequest (observing only, ineffective without host access and without an install warning), scripting and activeTab (page storage on click, without an install warning). Optional: https://*/* – requested only on “Record live” or an allowed page scan and handed back afterwards, without disturbing a recording in progress.
AuthTailor product documentation, README, “Privacy and permissions”; Chrome Web Store materials · checked on 2026-11-08
Vendor
CloudDNA GmbH – SAP Silver Partner
CloudDNA describes itself as an SAP BTP partner from Austria for the DACH region and an SAP Silver Partner; it supports SAP projects in Austria, Germany and Switzerland. Focus areas according to its website: integration, architecture and clean core, Fiori and UX, full-stack development, agility and DevOps, and training. Martin Koch is listed there as founder & managing director and SAP Champion.
clouddna.at, start page and team · checked on 2026-11-05
Books on security, connectivity and administration of SAP BTP
Martin Koch and Siegfried Zeilinger: “Security and Authorizations for SAP Business Technology Platform” (German edition “SAP Business Technology Platform – Sicherheit und Berechtigungen”), “Cloud Connector for SAP” (“Cloud Connector für SAP”) and “Configuring SAP Business Technology Platform” (“SAP Business Technology Platform – Administration”), all at SAP PRESS, Rheinwerk Verlag.
Rheinwerk Verlag (SAP PRESS), search “martin koch” · checked on 2026-11-05
iFlowTailor – workbench for SAP Cloud Integration
CloudDNA’s browser extension for SAP Integration Suite: review, testing, error analysis and operations next to the iFlow editor. The SAML & OIDC tracer that AuthTailor grew out of is one of its views.
iflowtailor.com · checked on 2026-11-08
Sources on this page
The superscript numbers in the text point here. Tap one to see the source right where it is used; all sources of this website are listed on one page.
- 1
Signatures really checked ↑Product · AuthTailor product documentation, README and changelog 1.0.0 · checked on 2026-11-08