Okta Access Gateway Application Fails With 502 Error During POST Request to SAML Module
Last Updated:
Overview
Okta Access Gateway (OAG) applications fail to load and return a 502 error when worker nodes cannot connect to the configured Lightweight Directory Access Protocol (LDAP) Data Store. Administrators must resolve the underlying connectivity issue or remove the LDAP attributes from the application configuration to restore access. When users attempt to access the application, Okta generates an error message.
502 Bad Gateway
Okta logs the following error during the POST request to the Security Assertion Markup Language (SAML) module of the OAG application. The request format appears as <shortName>/module.php/saml/sp/saml2-acs.php/<entityId> and references the upstream as fastcgi://unix:/var/run/php-fpm/php-fpm.sock.
2025-04-18T15:45:21.000-07:00 oag.testdomain.com oag.test.domain.com 5qx6V5WWL: 2025/04/18 15:45:21 [error] 929870#0: *26548335 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 10.132.65.68, server: oagldapapp.testdomain.com, request: "POST /5qx6V5WWL/module.php/saml/sp/saml2-acs.php/PgAp14RRQ HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm/php-fpm.sock:", host: "oagldapapp.testdomain.com", referrer: "https://testdomain.okta.com/"The OAG application configuration includes attributes that pull from a Data Store, as detailed in the Integrate Data Stores documentation.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Access Gateway (OAG)
- Applications Configured With Attributes That Pull From Data Stores
Cause
The application configuration pulls attributes from the LDAP Data Store, but the worker nodes fail to connect to it due to an environmental network issue. The LDAP Data Stores display as valid in the Admin UI because the Admin Node maintains connectivity, but the worker nodes experience connection failures. Okta logs the following error in the Monitor logs on the worker nodes, indicating that the LDAP Data Stores entered a failed status.
2025-03-31T03:29:39.226-07:00 oag.test.domain.com OAG_MONITOR MONITOR STORE ALERT VALIDATE [NAME="LDAP Test Store 1" STATUS="failed"] Failed to connect:Solution
How is the LDAP Data Store connectivity issue resolved?
Choose one of the following methods to resolve the LDAP Data Store connectivity issue and restore application access.
- If the application does not require the attributes from the LDAP Data Store, delete them from the application configuration to remove the dependency on the Data Store.
NOTE: Toggling the attribute to Do not Send does not resolve the issue. The attribute must be deleted. - If the application requires attributes from the LDAP Data Store, resolve any underlying network or credential issues preventing the worker nodes from connecting to it.
