Okta Access Gateway Admin Console Access Fails With a SimpleSAMLphp Configuration Error
Last Updated:
Overview
When accessing the Okta Access Gateway (OAG) Admin Console, Okta generates a configuration error. This occurs because a trusted domain on the Okta Identity Provider (IdP) side contains a special character in the URL that breaks the internal trusted domain file syntax in OAG. Remove the special character from the origin URL or delete the trusted domain, then disable and re-enable trusted domains in the OAG Management Console to resolve the issue. This error may occur after initially setting up an OAG node and adding an application or upon disabling and enabling trusted domains from the OAG Management Console. An existing Admin Console session may remain unaffected, but the next attempt to access the Admin Console results in the following error before reaching the login prompt.
Configuration error
SimpleSAML.php appears to be misconfigured.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Access Gateway (OAG)
Cause
Okta Access Gateway retrieves information about trusted domains from the Okta Identity Provider (IdP) and maintains an internal list of them in a PHP file. Okta Access Gateway populates this trusted domains file when creating an application or when an administrator disables or enables the trusted domains feature. A trusted domain on the Okta IdP side contains a special character in the URL that breaks the internal trusted domain file syntax in Okta Access Gateway.
The following image shows an example of a trusted domain URL that contains an apostrophe at the end.
NOTE: By default, the Okta Admin Console prevents adding certain special characters to the URL, but administrators can bypass this by using URL percent encoding.
Solution
How is the SimpleSAMLphp configuration error resolved?
Remove the problematic special character from the origin URL or delete the trusted domain on the Okta Identity Provider side, then disable and re-enable trusted domains in the Okta Access Gateway Management Console.
- On the Okta Identity Provider side, remove the problematic special character from the origin URL of the trusted domain or delete the trusted domain if it is no longer needed.
- Disable, then re-enable trusted domains in the Okta Access Gateway Management Console.
Identify the Problematic Trusted Domain Using the Okta Access Gateway Console Shell
Identify the problematic trusted domain by checking the contents of the internal trusted domains file via the Okta Access Gateway Console Shell using the provided command.
sudo cat /opt/oag/configs/simpleSAMLphp/config/trusteddomains.phpNOTE: If further assistance is required, open a case with Okta Support and provide the command output.
