Checking Trusted Proxy Configuration in Okta System Log

Administrators can use the Okta System Log to manually verify the trusted proxy configuration. This process involves examining requests that pass through the proxy to determine if the client IP address matches the last or second-to-last IP address in the IP chain.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• System Log
• Trusted Proxy

What steps verify a trusted proxy configuration in the Okta System Log?

Review requests that pass through the proxy in the System Log to determine if the Client.IPaddress matches the last or second-to-last IP address in the IP chain.

• If the Client.IPaddress matches the last IP address in the Request.IPChain.IP, a middleware application or networking device likely intercepted the request and failed to pass the originating client IP address (through X-Forwarded-For) to Okta.
• If the Client.IPaddress matches the second-to-last IP address in the Request.IPChain.IP, the service likely passes the correct information to Okta.

Analyze the System Log query example to identify a scenario where the client IP address matches the last IP address in the IP chain, indicating an improperly configured trusted proxy.

In the System Log query example, the Client.IPaddress matches the last IP address in the Request.IPChain.IP (the lowest listed in the System Log). The client IP address (172.70.142.130) belongs to the Cloudflare network. In this scenario, ThreatInsight evaluates the proxy device rather than the client that made the request. This indicates that the Cloudflare service lacks the proper configuration as a trusted proxy.