Unable to Access Okta Access Gateway App When It Is Behind a Proxy and Host Header Is Set to Private Domain
Last Updated:
Overview
When setting up a new header-based app in OAG, and the app is behind a proxy, admins want to make it global, which means the Host Header was set to "Private", but in the public domain, a public URL with a CNAME is in place, and it's pointing to OAG. After these changes are made, the application complains that it is not receiving the username from OAG, and the login fails.
Applies To
- Okta Access Gateway (OAG)
Solution
-
First, please consult the application and/or application server documentation on how to configure the application to be placed behind a reverse proxy or load-balancer.
-
If there is no documentation but still have the issue, first try enabling Host Header (Set it to "Public"):
-
Access the OAG Admin UI and edit the Application in question.
-
Under Advanced > enable Host Header (Set it to Public Domain).
-
-
If not working, please disable Host Headers > under Advanced > disable Host Header (Set it to Private Domain).
-
Next, click on Policies Tab > edit Root > Advanced > paste the script below > click on Not Validated > Save > Click Done.
proxy_set_header host $host:443;
-
Try accessing the app again.
-
If still unsuccessful, repeat step 3, but instead, type the following script and click on Not Validated > Save > click Done.
proxy_redirect ~^https://[^/]+(/.+)$ https://$host$1;
-
Try accessing the app again. Please open a support case if the issue persists.
