Okta Access Gateway Constant Redirects With Load Balancers

Okta Access Gateway (OAG) experiences a constant HTTP 302 redirect when session persistence issues occur with load balancers. This issue occurs when a load balancer uses a cookie name that conflicts with another cookie in the environment, preventing it from distinguishing its session cookie. Resolve this issue by isolating the load balancer and assigning unique cookie names.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)
• Front End Load Balancer 
• Application Load Balancer
• Cookie session persistence

When load balancers use cookies, those cookies are returned to the client and appear in developer tools. If a load balancer utilizes a cookie name that matches another cookie in the environment, multiple cookies with identical names but distinct values appear in the browser. When the browser sends cookies with the request, the load balancer detects a mismatch, creates a new session and cookie, and causes OAG to rotate between nodes constantly.

How is the load balancer identified as the root cause?

Isolate the load balancer to confirm that it causes the redirect loop by removing it from the traffic flow.

1. Remove each load balancer from the traffic flow one at a time and test the connection.
2. Remove all load balancers completely to verify if the redirect loop stops.

Unique cookie names resolve the redirect loop.

Prevent conflicts with other load balancers or applications by assigning a unique cookie name to the load balancer and validating the configuration using developer tools.

1. Configure the load balancer session cookie to use a unique name that does not conflict with other cookies in the environment.
2. Configure the load balancer cookie idle session timeout to match the idle session timeout set in Okta Access Gateway.
3. Open the browser developer tools and access the resource.
4. Check the cookie names that appear in the HTTP Archive (HAR) response to validate the configuration.
5. Temporarily configure encrypted cookies in clear text to easily trace the cookie names during testing.