Avoiding "502 Bad Gateway" Error During SAML Configuration for Palo Alto Captive Portal
Last Updated:
Overview
When logging in using the Palo Alto Networks - CaptivePortal app with a custom Okta domain, the following error might occur.
502 Bad Gateway
This article provides guidance on how to avoid this error and ensure a successful login.
Applies To
- Customers using a custom Okta domain
- Palo Alto Captive Portal
- SAML HTTP Binding for SSO Requests to IdP
- Secure Assertion Markup Language (SAML)
Cause
The 502 Bad Gateway error is usually triggered when using a custom Okta domain for "SAML HTTP Binding for SSO Requests to IdP" and selecting the Post option in the Service Provider (SP) configuration.
SAML messages need to be transmitted through URL parameters, and by selecting the Post option, they are transmitted using base64-encoded HTML instead.
Solution
The solution to this problem depends on the type of Okta domain in use:
-
If using a custom Okta domain (for example, sso.company.com), the Redirect option must be selected in the "SAML HTTP Binding for SSO Requests to IdP" in the Palo Alto Captive Portal settings.
-
If a regular Okta domain is used (for example,
<domain>.okta.com), the Post option should be selected in the "SAML HTTP Binding for SSO Requests to IdP" in the Palo Alto Captive Portal settings.
See How to Configure SAML 2.0 for Palo Alto Networks - CaptivePortal document for detailed step-by-step instructions.
