Okta Access Gateway NGINX Service Fails with a Proxy Pass URI Error

An NGINX service error occurs on Okta Access Gateway (OAG) when an application policy contains a regular expression in the location directive and the proxy pass contains additional Uniform Resource Identifier (URI) elements. Resolve this issue by enabling the case-sensitive setting for all policies or removing the additional URI element from the protected resource. When this error occurs, Okta fails to start the NGINX service or reload configuration changes. Administrators observe the following error in the logs or the management console.

nginx: [emerg] "proxy_pass" cannot have URI part in location given by regular expression, or inside named location, or inside "if" statement, or inside "limit_except" block in /etc/nginx/conf.d/icsgw_app_3071745c-061b-42fe-ac68-6cfe23002d5e.active.conf:168

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)

By default, Okta creates OAG application policies with the case-sensitive setting disabled. This configuration causes the NGINX configuration file policy to include a regular expression in the location directive. The regular expression allows NGINX to process the policy regardless of the case. Within the location block for each application policy, Okta adds a proxy pass directive that includes the protected resource. This directive allows NGINX to reverse proxy to the protected resource. When NGINX processes a policy where the location directive contains a regular expression, NGINX prevents the proxy pass from containing additional URI elements after the domain. This error occurs when the protected resource of the application includes an additional URI element after the domain (for example, https://example.com/URIelement) and the application includes a policy with the case-sensitive setting disabled.

How is the NGINX service error resolved?

Resolve the NGINX service error by enabling the case-sensitive setting for all policies or removing the additional URI element from the protected resource.

• Enable the Case sensitive setting for all policies on any application that contains a protected resource with an additional URI element after the domain (for example, https://example.com/URIelement).
• If the policy requires case insensitivity, reconfigure the application to remove the additional URI element from the end of the protected resource. This action might require reconfiguring other policies.