FerrisKeyAuthentication Flow Engine
Compass
Records every authentication attempt as a structured flow: named steps with their own outcomes, timings, and error details. You see how users actually authenticate.
Covers
Flow TracingStep TimingsError CodesAuth DebuggingObservabilityPending / Success / FailureDuration msGrant TypesPKCEAuthorization CodeKey capabilities
What Compass does for you.
- 01
Flow Recording
Each authentication request opens a CompassFlow, a complete record from the first request to the token or the failure.
- 02
Step-Level Detail
Nine step types tracked individually: authorize, credential validation, MFA, token exchange, IdP redirect and callback, the two SAML steps, and finalize.
- 03
Per-Step Timings
Every step records its duration in milliseconds. Spot slow Argon2 rounds, external IdP latency, or database bottlenecks.
- 04
Rich Error Context
Failures carry a machine-readable error code and a human-readable message, instead of a bare 401.
- 05
Zero Overhead Off
Disabled, the FlowRecorder short-circuits on entry: no channels, no writes, no allocations.
- 06
Queryable
Query flows by user, client, grant type, status, or time range through the admin API.
How it works
From the first request to the result, in 4 steps.
- 1
Flow created
Authentication request arrives. Compass creates a flow with realm, client, grant type, IP, and user agent.
- 2
Steps recorded
Every phase of authentication (authorize, credential check, MFA, token exchange) is recorded with its timing and outcome.
- 3
User identified
After successful credential validation, the user ID is attached to the flow, linking it for future queries.
- 4
Flow completed
Authentication finishes. The flow is marked success, failure, or expired with total duration in milliseconds.
Ready to use Compass?
Full reference, configuration options, and examples in the documentation.