OAG Questions During Initial Deployment

Last Updated: Jun 10, 2025

Access Gateway

Overview

This article discusses typical questions the support team has received from customers during initial deployment.

Why does the Admin need to resolve to the admin/standalone node server's IP?
- This is the main configuration for the admin UI application and how it is configured.
What is needed to set the cookie domain and hostname?

Below is a screenshot showing the setup screen:

- SSO Cookie Domain: This should be the domain of the Access gateway Hostname.
- Access Gateway Hostname: This is the cluster's name. The value will have admin appended to the hostname, and this is the URL to use to access the admin UI.

Below is a screenshot indicating the setup completion. The middle entry displays the URL redirected from when navigating to https://admin.

Setup Complete

Is it necessary to access the admin UI by ensuring the admin resolves to the IP address?
- The Okta access gateway serves applications using the host header attribute. The appliance is accessed with one IP address over 443 (https), so the host header attribute distinguishes the applications.
- To test this, see the difference with a curl:
  - This will show a 400 error because the host header is not defined, so it will send the IP address that the server requested with this host header:
    curl -v -k https://<ip address of server>
  - This will show a 302 redirect to the admin app:
    curl -v -k https://<ip address of server> -H 'Host:admin'
Why a Permission denied error is received when accessing the SSH management console with the default credentials?
1. For new installs of OAG versions 2025.3.0 and above, the SSH management console and Admin UI access is restricted to private networks only, i.e., it cannot be accessed using the appliance's public IP. If a private interface is not attached already, it may need to be added to the appliance. A jump box can be used to connect using a private IP if the user is not on the same network.