Member： Kenzo YOTSUYA, Takehiro KITAJIMA
Category: Underpinning
Background
Various authentication and authorization protocols are used every day on today’s Internet, but how they work remains a black box.
Purpose
Reduce the burden on developers and administrators of authentication and authorization systems by visualizing the authentication and authorization process, and contribute to the adoption of state-of-the-art authentication technologies.
Summary
We are developing SSOView, a Chrome browser extension that visualizes the single sign-on (SSO) process between the browser and web applications. When the user starts and stops capturing from the browser’s side panel, the tool records and analyzes the series of SSO exchanges (hereafter, “sessions”) and displays the flow on a custom-designed session details screen. SAML is currently supported, but only sessions executed in the tab where the side panel is open can be captured. Capturing sessions executed in other tabs is under development, and support for OpenID Connect is also planned.
Results
- Software: SSOView (Chrome browser extension, BSD 3-Clause License)
- The public version is in an early stage of development, so installation instructions and documentation are still being prepared.
Progress
FY2026 Q2
- Support for login screens opened in a separate tab: Toward capturing multiple tabs simultaneously, fully revised how the events used to manage the capture state are recorded and how captured data is managed, and built a foundation for processing multiple tabs in parallel. The required features will be implemented on top of this foundation.
- Public release: To verify the entire Chrome Web Store publishing process in advance, created a separate browser extension for this purpose and published it.
- Extension created: TabClipper (copies the titles and URLs of selected tabs to the clipboard)
FY2026 Q1
- Bug fixes: Fixed issues such as part of the session details screen being displayed incorrectly under certain conditions.
- Source code cleanup: In preparation for publishing the repository, reorganized the module structure and removed sensitive information from the test code, among other tasks.
- Test improvements: Updated the test environment and worked to improve test coverage.
- Public release: Prepared for distributing the browser extension.
- Published the repository on GitHub.
- Registered a developer account on the Chrome Web Store under the name IIJ Research Laboratory.
FY2025 Q4
- Session details feature: Improved quality by fixing minor bugs and writing unit tests, among other work.
- Service worker: Investigated how to support cases where a separate browser tab opens at the start of a session. The service worker handles capture and analysis in the background.
- Side panel: To unify the codebase with the already-integrated session details feature, refactored the code and migrated to the new version of the API provided by the service worker.
- Integration: Integrated the separately implemented components, such as the side panel and the session details screen, nearly completing the implementation of the basic features.
- Internal release: Prepared the manual and distribution packages, along with a CI (continuous integration) environment to build them, and released the tool internally at the end of March.
FY2025 Q3
- Session details feature: Combined the screen elements that had been implemented as individual components, completing the basic display functionality. Also improved the integration with the service worker, which serves as the backend, enhancing maintainability and extensibility.
- Side panel: Continuing from the previous quarter, worked on improving usability through design improvements. In particular, reflected insights from internal demonstrations in the design and improved the UI, for example by giving each screen a single function and simplifying it, and by using visual effects to make it easier to understand.
FY2025 Q2
- Session details feature: To improve usability, worked on improving the screen design used in the demo version built for functional testing. Also improved how screen elements are implemented (e.g., migrating from SVG to HTML+CSS and adopting Tailwind CSS), enhancing maintainability.
- Side panel: Revised the screen design to improve usability. Simplified operation by separating screens by function so that each serves a single purpose. Also improved the UI, for example by replacing buttons with toggle switches so that the processing state can be seen at a glance.
FY2025 Q1
- Session details feature: Based on insights gained from implementing the demo version built for functional testing, worked on a UI design that takes usability into account. Prototyped and evaluated mockups for migrating the rendering of objects that represent the authentication flow from SVG to HTML+CSS.
- Side panel: To make its look consistent with the session details screen, improved the design by introducing themes and dark mode. Also, since the planned features had largely been implemented, worked on fixing bugs and vulnerabilities.
FY2024 Q4
- Session details feature: Advanced the implementation of a UI that analyzes captured SAML session data and displays the results as an analysis report in the form of a sequence diagram, making it possible to display data from normal authentication flows.
- Side panel: With the UI implementation having reached a milestone, wrote the tests that had been postponed. For UI testing, introduced a test framework that runs in a web browser and set up its execution environment. Test coverage averaged about 70 to 80%.
FY2024 Q3
- Side panel: Advanced the implementation of the side panel, the main UI, reaching the stage where basic features such as the control UI and the SAML session status display work end to end.
- Service worker: Implemented features such as capturing and analyzing SAML sessions in the background, and importing and exporting captured sessions.
FY2024 Q2
- Development environment: Built IdP (Identity Provider) and SP (Service Provider) server environments for local testing.
- Functional specification: Defined the specifications of the final product, including the UI, and the milestones toward release.
- Internal beta development: Implemented the traffic capture processing and the side panel, the main control UI, among other components.
FY2024 Q1
- Started development.
- PoC (proof of concept) development: Investigated browser extension APIs and confirmed that the functions required to implement the SSO visualization tool, such as capturing requests and responses, can be achieved.
- Framework evaluation: Investigated frameworks for browser extension development and evaluated the pros and cons of adopting them. As a result, decided to defer adoption for the time being.