# ERR\_TOO\_MANY\_REDIRECTS after authenticating (Pomerium + IDP (Okta, Github or Azure AD) **URL:** \ **Category:** Support\ **Tags:** k8s\ **Created:** [April 22, 2024, 2:53pm UTC](https://discuss.pomerium.com/t/err-too-many-redirects-after-authenticating-pomerium-idp-okta-github-or-azure-ad/363 "2024-04-22T14:53:44Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![robmonct](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/robmonct/32/147_2.png) [@robmonct](https://discuss.pomerium.com/u/robmonct)\ **Post date:** [April 22, 2024, 2:53pm UTC](https://discuss.pomerium.com/t/err-too-many-redirects-after-authenticating-pomerium-idp-okta-github-or-azure-ad/363/1 "2024-04-22T14:53:44Z")
Dear team, I’m trying to use Pomerium to work as a Identity-Aware Proxy in Azure AKS. I followed the Pomerium Kubernetes Quickstart ([Kubernetes Quickstart | Pomerium](https://www.pomerium.com/docs/deploy/k8s/quickstart)) and worked fine. After that, I followed the [installation](https://www.pomerium.com/docs/deploy/k8s/install), [global configuration](https://www.pomerium.com/docs/deploy/k8s/configure) and [ingress configuration](https://www.pomerium.com/docs/deploy/k8s/ingress). If I use the Hosted Authenticate service, everything works fine. Any help would be appreciated team. This is the Global configuration: ```auto apiVersion: ingress.pomerium.io/v1 kind: Pomerium metadata: name: global spec: secrets: pomerium/bootstrap authenticate: url: https://authenticate.pomerium.app certificates: - pomerium/pomerium-wildcard-tls ``` ## What happened? If I try to use a different IDP provider (I’ve tried with Okta, Github and Azure AD), I get the error **ERR\_TOO\_MANY\_REDIRECTS** when I try to access to a service only for authenticated users. This is the Global configuration: ```auto --- apiVersion: ingress.pomerium.io/v1 kind: Pomerium metadata: name: global spec: authenticate: url: https://auth.dev.example.com cookie: domain: auth.dev.example.com certificates: - pomerium/my-tls-wildcard-secret identityProvider: provider: azure url: https://login.microsoftonline.com/tenant-id/v2.0 secret: pomerium/azure secrets: pomerium/bootstrap ``` This is what I can see into the browser network when I try to go to one of the protected services: [https://nginx-promerium.dev.example.com](https://nginx-promerium.dev.example.com) ![image](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/070f4decb5ede35433d6a90f0e4a4576164cd019.jpeg) However, I’m able to go to the same internal service using the annotation: allow\_public\_unauthenticated\_access [https://nginx-pomerium-unauth.dev.example.com](https://nginx-pomerium-unauth.dev.example.com) If I try to go to verify page, I get the same **ERR\_TOO\_MANY\_REDIRECTS**. Nevertheless, I’m able to go the auth page: [https://auth.dev.example.com/.pomerium/](https://auth.dev.example.com/.pomerium/) ## What’s your environment like? - Pomerium version (retrieve with `pomerium --version`): v0.25.2 - Server Operating System/Architecture/Cloud: Azure AKS - Kubernetes version 1.28.5 ## What’s your ingress conf? ```auto --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: verify namespace: pomerium annotations: ingress.pomerium.io/allow_any_authenticated_user: 'true' ingress.pomerium.io/pass_identity_headers: 'true' spec: ingressClassName: pomerium tls: - hosts: - verify.dev.example.com secretName: my-tls-wildcard-secret rules: - host: verify.dev.example.com http: paths: - pathType: Prefix path: / backend: service: name: verify port: number: 443 --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: nginx-pomerium namespace: pomerium annotations: ingress.pomerium.io/allow_any_authenticated_user: 'true' ingress.pomerium.io/pass_identity_headers: 'true' spec: ingressClassName: pomerium tls: - hosts: - nginx-pomerium.dev.example.com secretName: my-tls-wildcard-secret rules: - host: nginx-pomerium.dev.example.com http: paths: - pathType: Prefix path: / backend: service: name: http-svc port: number: 80 --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: nginx-pomerium-unauth namespace: pomerium annotations: ingress.pomerium.io/allow_public_unauthenticated_access: 'true' ingress.pomerium.io/pass_identity_headers: 'true' spec: ingressClassName: pomerium tls: - hosts: - nginx-pomerium-unauth.dev.example.com secretName: my-tls-wildcard-secret rules: - host: nginx-pomerium-unauth.dev.example.com http: paths: - pathType: Prefix path: / backend: service: name: http-svc port: number: 80 --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: auth-pomerium namespace: pomerium annotations: ingress.pomerium.io/allow_public_unauthenticated_access: 'true' ingress.pomerium.io/pass_identity_headers: 'true' spec: ingressClassName: pomerium tls: - hosts: - auth.dev.example.com secretName: my-tls-wildcard-secret rules: - host: auth.dev.example.com http: paths: - pathType: Prefix path: / backend: service: name: pomerium-proxy port: number: 443 ``` ## What did you see in the logs? `kubectl describe pomerium global` ```logs Name: global Namespace: Labels: argocd.argoproj.io/instance=asm-config Annotations: API Version: ingress.pomerium.io/v1 Kind: Pomerium Metadata: Creation Timestamp: 2024-04-19T11:21:01Z Generation: 34 Resource Version: 29548440 UID: 2b975cb7-dca8-46be-bef0-816a112995e9 Spec: Authenticate: URL: https://auth.dev.example.com Certificates: pomerium/my-tls-wildcard-secret Cookie: Domain: auth.dev.example.com Identity Provider: Provider: azure Secret: pomerium/azuretenant-id/0fe65e77-cff2-4f4e-b604-796a2bd02763/v2.0 Secrets: pomerium/bootstrap Status: Ingress: pomerium/auth-pomerium: Observed At: 2024-04-22T14:04:11Z Observed Generation: 7 Reconciled: true pomerium/nginx-pomerium: Observed At: 2024-04-22T14:11:25Z Observed Generation: 13 Reconciled: true pomerium/nginx-pomerium-unauth: Observed At: 2024-04-22T14:11:25Z Observed Generation: 1 Reconciled: true pomerium/verify: Observed At: 2024-04-22T13:58:25Z Observed Generation: 1 Reconciled: true Settings Status: Observed At: 2024-04-22T13:53:23Z Observed Generation: 34 Reconciled: true Warnings: storage: please specify a persistent storage backend, please see https://www.pomerium.com/docs/topics/data-storage#persistence Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Updated 50m (x10 over 2d16h) bootstrap pod/pomerium-7f654667d9-fnwh7 config updated Warning Validation 50m (x10 over 2d16h) pomerium-crd storage: please specify a persistent storage backend, please see https://www.pomerium.com/docs/topics/data-storage#persistence Normal Updated 50m (x10 over 2d16h) pomerium-crd config updated Normal Updated 45m (x26 over 2d16h) pomerium-ingress pomerium/verify: config updated Normal Updated 39m (x32 over 2d16h) pomerium-ingress pomerium/auth-pomerium: config updated Normal Updated 32m (x39 over 2d16h) pomerium-ingress pomerium/nginx-pomerium: config updated Normal Updated 32m (x2 over 32m) pomerium-ingress pomerium/nginx-pomerium-unauth: config updated ``` `k logs -f $(k get po -n pomerium | grep -v secrets | grep pomerium | awk '{print $1}') -n pomerium` ```auto {"level":"info","type":"type.googleapis.com/user.ServiceAccount","query":"","offset":0,"limit":1,"filter":{"$or":[{"id":""},{"$index":""}]},"time":"2024-04-22T14:45:35Z","message":"query"} {"level":"info","type":"type.googleapis.com/session.Session","query":"","offset":0,"limit":1,"filter":{"$or":[{"id":""},{"$index":""}]},"time":"2024-04-22T14:45:35Z","message":"query"} {"level":"info","service":"authorize","request-id":"71f368de-2d2b-4bdf-ab29-a845e31e2daf","check-request-id":"71f368de-2d2b-4bdf-ab29-a845e31e2daf","method":"GET","path":"/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.8","user":"","email":"","allow":false,"allow-why-false":["user-unauthenticated"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","service":"authorize","request-id":"1f576380-6f69-4c25-8d8e-bd339d12499f","check-request-id":"1f576380-6f69-4c25-8d8e-bd339d12499f","method":"GET","path":"/.pomerium/sign_in","host":"auth.dev.example.com","ip":"10.136.0.13","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","type":"type.googleapis.com/session.Session","id":"d5409c13-204e-46b4-88c9-d6d16f13744a","time":"2024-04-22T14:45:35Z","message":"get"} {"level":"info","service":"authorize","request-id":"641b726c-992b-475e-b125-cc4e36157596","check-request-id":"641b726c-992b-475e-b125-cc4e36157596","method":"GET","path":"/.pomerium/callback/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.13","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","service":"authorize","request-id":"9ac02065-acef-42ea-a776-2f85a39842b3","check-request-id":"9ac02065-acef-42ea-a776-2f85a39842b3","method":"GET","path":"/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.9","user":"","email":"","allow":false,"allow-why-false":["user-unauthenticated"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","service":"authorize","request-id":"1c803fc9-b23f-4e79-8e79-011cb9d2bf83","check-request-id":"1c803fc9-b23f-4e79-8e79-011cb9d2bf83","method":"GET","path":"/.pomerium/sign_in","host":"auth.dev.example.com","ip":"10.136.0.9","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","type":"type.googleapis.com/session.Session","id":"d5409c13-204e-46b4-88c9-d6d16f13744a","time":"2024-04-22T14:45:35Z","message":"get"} {"level":"info","service":"authorize","request-id":"741774ba-27f8-4578-98da-a9e210fddfb3","check-request-id":"741774ba-27f8-4578-98da-a9e210fddfb3","method":"GET","path":"/.pomerium/callback/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.8","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","service":"authorize","request-id":"1d54a649-a929-459f-8c8e-3bdcbac98e22","check-request-id":"1d54a649-a929-459f-8c8e-3bdcbac98e22","method":"GET","path":"/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.13","user":"","email":"","allow":false,"allow-why-false":["user-unauthenticated"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"auth.dev.example.com","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51274,10.136.0.13","request-id":"1f576380-6f69-4c25-8d8e-bd339d12499f","duration":11.539246,"size":1022,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:35Z","message":"http-request"} {"level":"info","service":"authorize","request-id":"ae845e2a-7a63-4836-a5a6-87878bb8e232","check-request-id":"ae845e2a-7a63-4836-a5a6-87878bb8e232","method":"GET","path":"/.pomerium/sign_in","host":"auth.dev.example.com","ip":"10.136.0.8","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","type":"type.googleapis.com/session.Session","id":"d5409c13-204e-46b4-88c9-d6d16f13744a","time":"2024-04-22T14:45:35Z","message":"get"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"auth.dev.example.com","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51274,10.136.0.9","request-id":"1c803fc9-b23f-4e79-8e79-011cb9d2bf83","duration":4.539039,"size":1023,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:35Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/.pomerium/callback/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.13","request-id":"641b726c-992b-475e-b125-cc4e36157596","duration":3.071859,"size":88,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:35Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.9","request-id":"9ac02065-acef-42ea-a776-2f85a39842b3","duration":2.858062,"size":1486,"response-code":302,"response-code-details":"ext_authz_denied","time":"2024-04-22T14:45:35Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.13","request-id":"1d54a649-a929-459f-8c8e-3bdcbac98e22","duration":2.575765,"size":1486,"response-code":302,"response-code-details":"ext_authz_denied","time":"2024-04-22T14:45:35Z","message":"http-request"} {"level":"info","service":"authorize","request-id":"8561b80f-a23c-4d1d-b8d3-0bacba6c3d56","check-request-id":"8561b80f-a23c-4d1d-b8d3-0bacba6c3d56","method":"GET","path":"/.pomerium/callback/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.9","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","service":"authorize","request-id":"3b72ba9c-788e-4503-89c3-3d91b97bcbdc","check-request-id":"3b72ba9c-788e-4503-89c3-3d91b97bcbdc","method":"GET","path":"/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.8","user":"","email":"","allow":false,"allow-why-false":["user-unauthenticated"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","service":"authorize","request-id":"e6d509e7-0cfa-4b32-9b41-5ca5e63eda7d","check-request-id":"e6d509e7-0cfa-4b32-9b41-5ca5e63eda7d","method":"GET","path":"/.pomerium/sign_in","host":"auth.dev.example.com","ip":"10.136.0.13","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","type":"type.googleapis.com/session.Session","id":"d5409c13-204e-46b4-88c9-d6d16f13744a","time":"2024-04-22T14:45:35Z","message":"get"} {"level":"info","service":"authorize","request-id":"b6d18dec-53f3-4ab8-81b0-383606b6db45","check-request-id":"b6d18dec-53f3-4ab8-81b0-383606b6db45","method":"GET","path":"/.pomerium/callback/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.13","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","service":"authorize","request-id":"7f116cac-943f-4f4e-950c-2919224c70d6","check-request-id":"7f116cac-943f-4f4e-950c-2919224c70d6","method":"GET","path":"/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.9","user":"","email":"","allow":false,"allow-why-false":["user-unauthenticated"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","service":"authorize","request-id":"668ab027-3481-448f-bfaa-f5cee3fcad4e","check-request-id":"668ab027-3481-448f-bfaa-f5cee3fcad4e","method":"GET","path":"/.pomerium/sign_in","host":"auth.dev.example.com","ip":"10.136.0.9","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","type":"type.googleapis.com/session.Session","id":"d5409c13-204e-46b4-88c9-d6d16f13744a","time":"2024-04-22T14:45:35Z","message":"get"} {"level":"info","service":"authorize","request-id":"67a93b36-d61c-4230-8712-6190bfe79a7e","check-request-id":"67a93b36-d61c-4230-8712-6190bfe79a7e","method":"GET","path":"/.pomerium/callback/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.8","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","service":"authorize","request-id":"ac0b9f68-aebf-47c7-8d7a-835fdc904b60","check-request-id":"ac0b9f68-aebf-47c7-8d7a-835fdc904b60","method":"GET","path":"/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.13","user":"","email":"","allow":false,"allow-why-false":["user-unauthenticated"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:35Z","message":"authorize check"} {"level":"info","service":"envoy","upstream-cluster":"","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.8","request-id":"71f368de-2d2b-4bdf-ab29-a845e31e2daf","duration":5.048933,"size":1486,"response-code":302,"response-code-details":"ext_authz_denied","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/.pomerium/callback/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.8","request-id":"741774ba-27f8-4578-98da-a9e210fddfb3","duration":3.310556,"size":88,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"auth.dev.example.com","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51274,10.136.0.8","request-id":"ae845e2a-7a63-4836-a5a6-87878bb8e232","duration":4.43234,"size":1022,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.8","request-id":"3b72ba9c-788e-4503-89c3-3d91b97bcbdc","duration":2.533066,"size":1486,"response-code":302,"response-code-details":"ext_authz_denied","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/.pomerium/callback/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.8","request-id":"67a93b36-d61c-4230-8712-6190bfe79a7e","duration":3.01216,"size":88,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"authorize","request-id":"db6a17e2-dd9f-4d63-a4a9-0a14f2eb912a","check-request-id":"db6a17e2-dd9f-4d63-a4a9-0a14f2eb912a","method":"GET","path":"/.pomerium/sign_in","host":"auth.dev.example.com","ip":"10.136.0.8","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:36Z","message":"authorize check"} {"level":"info","type":"type.googleapis.com/session.Session","id":"d5409c13-204e-46b4-88c9-d6d16f13744a","time":"2024-04-22T14:45:36Z","message":"get"} {"level":"info","service":"authorize","request-id":"64dc67a1-593f-4f7a-9ddf-ac5c8ee1267e","check-request-id":"64dc67a1-593f-4f7a-9ddf-ac5c8ee1267e","method":"GET","path":"/.pomerium/callback/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.9","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:36Z","message":"authorize check"} {"level":"info","service":"authorize","request-id":"f470e984-4f6f-4045-8740-09ba8a315f5f","check-request-id":"f470e984-4f6f-4045-8740-09ba8a315f5f","method":"GET","path":"/","host":"nginx-pomerium.dev.example.com","ip":"10.136.0.8","user":"","email":"","allow":false,"allow-why-false":["user-unauthenticated"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:36Z","message":"authorize check"} {"level":"info","service":"authorize","request-id":"f294dee8-8041-41a9-b414-fc7087f1907a","check-request-id":"f294dee8-8041-41a9-b414-fc7087f1907a","method":"GET","path":"/.pomerium/sign_in","host":"auth.dev.example.com","ip":"10.136.0.13","user":"","email":"","allow":true,"allow-why-true":["pomerium-route"],"deny":false,"deny-why-false":[],"time":"2024-04-22T14:45:36Z","message":"authorize check"} {"level":"info","type":"type.googleapis.com/session.Session","id":"d5409c13-204e-46b4-88c9-d6d16f13744a","time":"2024-04-22T14:45:36Z","message":"get"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"auth.dev.example.com","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51274,10.136.0.13","request-id":"e6d509e7-0cfa-4b32-9b41-5ca5e63eda7d","duration":4.440141,"size":1022,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"auth.dev.example.com","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51274,10.136.0.13","request-id":"f294dee8-8041-41a9-b414-fc7087f1907a","duration":10.756256,"size":1023,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"auth.dev.example.com","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51274,10.136.0.9","request-id":"668ab027-3481-448f-bfaa-f5cee3fcad4e","duration":4.766236,"size":1023,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/.pomerium/callback/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.9","request-id":"8561b80f-a23c-4d1d-b8d3-0bacba6c3d56","duration":3.319056,"size":88,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/.pomerium/callback/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.13","request-id":"b6d18dec-53f3-4ab8-81b0-383606b6db45","duration":2.95936,"size":88,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.9","request-id":"7f116cac-943f-4f4e-950c-2919224c70d6","duration":2.628065,"size":1486,"response-code":302,"response-code-details":"ext_authz_denied","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.13","request-id":"ac0b9f68-aebf-47c7-8d7a-835fdc904b60","duration":2.584866,"size":1486,"response-code":302,"response-code-details":"ext_authz_denied","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/.pomerium/callback/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.9","request-id":"64dc67a1-593f-4f7a-9ddf-ac5c8ee1267e","duration":3.01116,"size":88,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:36Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"auth.dev.example.com","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51274,10.136.0.8","request-id":"db6a17e2-dd9f-4d63-a4a9-0a14f2eb912a","duration":13.42572,"size":1024,"response-code":302,"response-code-details":"via_upstream","time":"2024-04-22T14:45:37Z","message":"http-request"} {"level":"info","service":"envoy","upstream-cluster":"","method":"GET","authority":"nginx-pomerium.dev.example.com","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","referer":"","forwarded-for":"88.17.253.147:51272,10.136.0.8","request-id":"f470e984-4f6f-4045-8740-09ba8a315f5f","duration":2.527666,"size":1486,"response-code":302,"response-code-details":"ext_authz_denied","time":"2024-04-22T14:45:37Z","message":"http-request"} ``` ---
**Author:** ![denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@denis](https://discuss.pomerium.com/u/denis)\ **Post date:** [April 22, 2024, 4:26pm UTC](https://discuss.pomerium.com/t/err-too-many-redirects-after-authenticating-pomerium-idp-okta-github-or-azure-ad/363/2 "2024-04-22T16:26:18Z")
> [@robmonct](#): > > ```auto > cookie: > domain: auth.dev.example.com > > ``` please try removing this parameter. The pomerium cookie is required in order to carry the Pomerium session reference across browser requests. By setting this to `auth.dev.example.com`, you do not allow `verify.dev.example.com` to have, which causes the infinite redirect. ---
**Author:** ![robmonct](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/robmonct/32/147_2.png) [@robmonct](https://discuss.pomerium.com/u/robmonct)\ **Post date:** [April 22, 2024, 7:07pm UTC](https://discuss.pomerium.com/t/err-too-many-redirects-after-authenticating-pomerium-idp-okta-github-or-azure-ad/363/3 "2024-04-22T19:07:29Z")
Thanks, that was the cause of the problem.