Shibboleth SP & Okta IdP Redirect Looping

Paul Carroll pcarroll at
Thu Jul 30 13:53:15 UTC 2020

OK, thanks Peter and Scott.  I looked at the page that describes debugging the looping but it was early on in the process.  I will take another look since I know more about it now.

Peter, I resubmitted my issue using text.  I thought I may have to resubmit.  Please disregard the resubmitted issue.


--- cantor.2 at wrote:

From: "Cantor, Scott" <cantor.2 at>
To: Shib Users <users at>
Subject: Re: Shibboleth SP & Okta IdP Redirect Looping
Date: Thu, 30 Jul 2020 13:35:35 +0000

Assuming the shibd log records a session being created and then immediately invalidated or destroyed, the syslog/native log stream will likely log why it's rejecting the sessions immediately after establishment; IP address instability perhaps.

As for how to debug it if there's no apparent issue other than cookies going missing...

1. Learn how the SP works and uses cookies at all steps by observing working transactions and reading the documentation that describes all the steps. [1]
2. Trace to identify where the cookie(s) go missing.

-- Scott


For Consortium Member technical support, see
To unsubscribe from this list send an email to users-unsubscribe at

More information about the users mailing list