Okta generates a 403 Forbidden error for users with the Apple iCloud Relay Proxy enabled when an Enhanced Dynamic Network Zone blocks all anonymizers. Deactivating the default enhanced dynamic zone and creating an exception for the iCloud Relay Proxy resolves this issue.

When an Enhanced Dynamic Network Zone blocks the ALL_ANONYMIZERS category, users with the Apple iCloud Relay Proxy enabled receive the following error:

403 Forbidden

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Enhanced Dynamic Network Zone
• Apple iCloud Private Relay Proxy

Okta blocks the ALL_ANONYMIZERS category, which includes the APPLE_ICLOUD_RELAY_PROXY category. This causes the clients to meet the criteria for blocking by the Enhanced Dynamic Network Zone condition.

How is the default enhanced dynamic zone deactivated?

Navigate to the network settings in the Okta Admin Console and deactivate the default enhanced dynamic zone.

1. In the Okta Admin Console, go to Security > Networks.
2. Navigate to the DefaultEnhancedDynamicZone.
   
3. Click Active, then click Inactive to deactivate the zone.
   

How is an exception created for the iCloud Relay Proxy?

Add a new enhanced dynamic zone in the Okta Admin Console and configure it to block all IP service categories except the Apple iCloud Relay Proxy.

1. In the Okta Admin Console, go to Security > Networks.
2. Select Add zone > Enhanced Dynamic Zone.
   
3. Enter a Zone name.
4. Select Block access from IPs matching conditions to block the IP service category, locations, and Autonomous System Numbers (ASNs) in the zone.
   
5. Select All IP service categories except and enter APPLE_ICLOUD_RELAY_PROXY.
   
   
   • Include locations: The zone includes the locations selected in the next step. If the option remains as None, the dynamic zone includes all locations.
   • All locations except: The zone excludes the locations selected in the next step. The zone includes all other locations. In the Location field, enter the country, state, or region, if applicable. Click Add Another to add more locations.
6. In the Internet Service Provider (ISP) autonomous system numbers (ASNs) field, enter the ASNs to include in the zone.
7. Click Save.
8. Set the network zone to Active.

Related References

• Create an enhanced dynamic zone
• 403 Access Forbidden on Okta Login from iOS Mobile Devices