An Okta Access Gateway (OAG) application access attempt fails with a redirect error in the browser. This issue occurs when the protected web resource uses an incorrect protocol, the public and protected web resources resolve to the OAG appliance IP address, or network resolution issues exist. Administrators must verify the protected web resource URL, perform a Domain Name System (DNS) lookup, and execute a cURL test.

The issue does not occur when accessing the application directly without OAG. Okta generates the following error message:

ERR_TOO_MANY_REDIRECTS

The browser developer tools do not show the x-oag-host header or the OAG session cookie SessionCookieHFL16428SINFE71QMY4V value changing, indicating that a valid OAG session persists on a single node.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)

This issue occurs in the following scenarios:

• The protected web resource for the configured application uses an incorrect protocol. For example, the backend web application uses HTTPS, but the OAG protected web resource uses HTTP. When the backend receives an HTTP request, it redirects to HTTPS, which creates a loop and generates the ERR_TOO_MANY_REDIRECTS error.
• The public and protected web resources are identical and both resolve to the OAG appliance IP address.
• Network or resolution issues exist.

How is the too many redirects error resolved?

Verify the protected web resource URL, perform a Domain Name System lookup, and execute a cURL test to resolve the error.

• Verify that the protected web resource matches the exact URL used to access the application directly.
• Verify that the host resolution is correct using a DNS lookup.
• Verify that Curl tests from the OAG appliance receive the same response from the backend as when executed directly from the client machine.

Related References

• DNS Lookup
• Connectivity test (cURL) ​​​​​​​