<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D50Z00008G7UqXSAVOkta Classic EngineOkta Integration NetworkAnswered2024-04-30T09:18:25.000Z2015-12-09T16:38:55.000Z2020-10-19T18:39:24.000Z

j5v7c (j5v7c) asked a question.

December 9, 2015 at 4:38 PM
ELB healthcheck causing redirect loop
We are trying to set up JIRA to authenticate via Okta. We use AWS ELB and have a healthcheck that runs to ensure the app is available. The ELB looks for a return code of 200. Okta returms a 302 (redirect). The healthcheck looks for <JIRA base url>/status. This url does not require authentication, so why is Okta trying to redirect the healthcheck?
  • 5 answers
  • 1.2K views

  • Wils (Okta, Inc.)

    Hi Jeanne,

     

    Is the ELB healthchecking Okta or JIRA? You said "Okta returns a 302 redirect" so it sounds like your ELB might be going through Okta to check the JIRA app. It seems like it should be checking JIRA directly, not going through Okta. If you're trying to healthcheck the JIRA app through Okta, you'll get a 302 redirect to JIRA. So that would be the first thing I'd ensure (the ELB is checking JIRA directly).

     

    If that's already the case, JIRA (or some other system that intercepts the healthcheck) would be redirecting to Okta with a 302. If that's the case, it sounds like JIRA is configured to authenticate a user that tries to hit that endpoint, or something else is intercepting the request and kicking it back to Okta for authentication. For confirmation, can you provide the Okta url that's in the 302 from JIRA?

     

    Thanks,

    Wils
    Expand Post

  • j5v7c (j5v7c)

    Wils,

    The ELB checks JIRA directly, it should not be going thorugh Okta. Here is the write-out to the log file:

    2015-12-08 15:47:36,807 http-bio-8080-exec-2 INFO anonymous 947x22x22 - 10.221.5.80 /status [jira.authenticator.okta.OktaJiraAuthenticator] User wasn't fou

    nd not in session, nor in assertion, redirecting to: https://mhe.oktapreview.com/app/jira_onprem/exk51bvii8MdvN1hw0h7/sso/saml?RelayState=https%3A%2F%2Fjir

    adev.mheducation.com%2Fstatus

     

    I think the issue is in the way Okta was configure. It is configured to use the <JIAR base url>. I beleave it should be configured to use the <JIRA base url>/secure/Dashboard.jspa
    Expand Post

  • Wils (Okta, Inc.)

    Jeanne,

    Yes that thought is probably correct. Looks like JIRA is expecting a valid session for the /status endpoint. I'm not sure how JIRA can be configured to exclude that endpoint and whether or not it's on the Okta side or the JIRA side, but someone else in the community may be able to help you there. I believe the configuration change will need to be made in JIRA, but am not familiar with that interaction specifically.

    Thanks and good luck,

     

    Wils
    Expand Post

    • gfzle (gfzle)

      Wils,

       

      do you happen to know if a solution was ever found with this? We are running into same issue.

       

      Thank you!

      • tim.lopez1.5480328098306519E12 (Okta, Inc.)

        Hello N Luna,

         

        As this question is 5 years old, it's likely that many things have changed since then. If you're running in to issues with this, please contact our support team and create a case so they can get this taken care of for you, or feel free to start a new thread detailing the specific issues you are having.

         

        Thanks!

        Tim

        Expand Post
This question is closed.
Loading
ELB healthcheck causing redirect loop