菜单
Use when investigating tenant SSO/login issues with AuthenticationLog, AuthorizationPolicy, and optional AuditLog—correlating IdP claims with Endor policy mapping, "no authorized tenant" symptoms, or exporting structured flow-agnostic auth investigation JSON.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | endor-troubleshoot-authlog |
| description | Use when investigating tenant SSO/login issues with AuthenticationLog, AuthorizationPolicy, and optional AuditLog—correlating IdP claims with Endor policy mapping, "no authorized tenant" symptoms, or exporting structured flow-agnostic auth investigation JSON. |
Systematic workflow for Endor-side evidence: what the platform recorded at login
(AuthenticationLog) versus how access is configured (AuthorizationPolicy).
uv run --env-file .env python ... (browser refresh: uv run endor-auth refresh --method sso -n <tenant>).
uv run endor-auth check --tenant <tenant>..endorlabs-context/platform/openapi/openapiv2.swagger.json;
resource models in src/endorlabs/resources/authentication_log.py,
authorization_policy.pyAuthenticationLog and
AuthorizationPolicy on the target tenant list path.AuthenticationLog via endorlabs.workflows.auth on the tenant list path
(namespace=<tenant>, traverse=False) with a time-bounded server filter — not unfiltered
traverse=True sweeps.AuthorizationPolicy under the same tenant (use traverse=True only when policy
rows live in child namespaces)..endorlabs-context/workspace/runs/troubleshoot-authlog/.Preset RCA stack: probe_auth_logs → filter_auth_logs_by_email → auth_log_snapshot.
Use probe_auth_logs (not list_auth_logs) — broader rows including failures and
authorized_tenants. For custom filters, compose auth_log_filter +
client.AuthenticationLog.list → normalize_auth_log. Full layer map:
endorlabs.workflows.auth.authentication_log module docstring.
Tenant trap: namespace=<tenant> on list; never tenant_meta.namespace in MQL.
import endorlabs
from endorlabs.workflows.auth import (
auth_log_snapshot,
probe_auth_logs,
filter_auth_logs_by_email,
)
client = endorlabs.Client(tenant="<tenant-hint>")
rows = probe_auth_logs(
client,
namespace="<tenant-hint>",
days=30,
max_pages=10,
)
# Optional: narrow to one user
rows = filter_auth_logs_by_email(rows, "user@example.com")
snapshots = [auth_log_snapshot(row) for row in rows]
client.close()
Defaults include failed logins and non-interactive URIs (broader than login-count).
For login counts only, see
endor-workflow-reports
(list_groups on spec.claims — server-side aggregation).
import endorlabs
client = endorlabs.Client(tenant="<tenant-hint>")
policies = client.AuthorizationPolicy.list(traverse=True, max_pages=2)
client.close()
For structured exports, write JSON under .endorlabs-context/workspace/runs/troubleshoot-authlog/
(see workspace-layout).
SSO claim-to-namespace mapping: endor-sso-integration-validation-troubleshooting
(sso_access_spotcheck.py uses the same probe_auth_logs helper).
spec.claims uses list membership filters (contains); regex on claims is
easy to misuse — the utility prefers exact contains strings./v1/auth/api-key and
issuing_user=...; narrow with filter= on spec.uri for SAML/OIDC callbacks
(auth/saml-callback, auth/sso, tenant=<name>) before correlating tenants.authorized_tenants in a row vs spec.uri with tenant=... — compare
both when reasoning about tenant mapping.namespace=<tenant> on AuthenticationLog — do not filter
tenant_meta.namespace (rows may show system but return on the tenant list path).| Need | Skill |
|---|---|
| Credential setup / refresh | endor-auth-setup |
| SSO setup / claim-to-namespace spot-check | endor-sso-integration-validation-troubleshooting |
| Broader SDK debugging | endor-troubleshoot-sdk |
| Contributing | docs/contributing/troubleshooting.md |
Use when probing, verifying, or refreshing Endor Labs SDK credentials before API workflows—env-key scan, Client whoami check, endorctl detection, and interactive browser token refresh into .env. Step zero for any tenant session. Not for SSO policy mapping or AuthenticationLog RCA.
Use when authoring, validating, or importing custom OpenGrep/Semgrep rule YAML into Endor Labs SemgrepRule resources—rule syntax, Endor metadata shape, local opengrep/semgrep checks, or namespace import. Not for finding triage (hand off to endor-retrieve-scan-results).
Use when resolving package-version lineage by manifest path and source ref/sha, or distinguishing direct vs transitive introduction paths—especially when the same package appears at multiple versions or via multiple manifest files.
Fetch project call graph artifacts, decode zstd payloads into searchable node and edge files, and run safe direct-edge or multi-hop path searches on the customer PackageVersion plane. Use for static symbol paths (e.g. app code to a dependency API)—not for Finding/CVE reachability triage (hand off to endor-reachability-provenance), scan finding lists (endor-retrieve-scan-results), or natural-language function summaries (VectorStoreQuery; separate flow).
Use when extending the SDK client surface after OpenAPI changes—model sync, registry overlay, payload builders, and integration tests—when a new API resource appears, facade behavior diverges from the generated contract, or list/get/create needs validation. Not for hand-implementing every resource from scratch.
Use when triaging OpenAPI / model-sync upstream drift—CI or pre-push verify-upstream-only failures, or published endorctl newer than committed provenance. Covers regenerating registry_contract, stubs, and reference docs; reviewing generated diffs; optional local endorctl upgrades. Not for runtime SDK API errors (endor-troubleshoot-sdk).