{"record":{"id":"0c38fd95cf89dc6e","repo":"gravitational/teleport","slug":"connection-downgrade-not-allowed-for-url","errorCode":null,"errorMessage":"connection downgrade not allowed for URL: ","messagePattern":"connection downgrade not allowed for URL: ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/services/saml.go","lineNumber":270,"sourceCode":"\t\t\treturn\n\t\t}\n\t\tif params.MFA {\n\t\t\tlog.ErrorContext(ctx, \"Failed to fetch or parse SAML MFA entity descriptor\", \"error\", err)\n\t\t} else {\n\t\t\tlog.ErrorContext(ctx, \"Failed to fetch or parse SAML entity descriptor\", \"error\", err)\n\t\t}\n\t\terr = trace.Wrap(ErrFailedToFetchOrParseEntityDescriptor)\n\t}()\n\n\tif url != \"\" && !params.Options.NoFollowURLs {\n\t\tvar checkRedirect func(req *http.Request, via []*http.Request) error\n\t\t// TODO(kopiczko): Remove this env var after Jul 2027 (one year since introduced) if no issue is reported.\n\t\tif disableCheckRedirect, _ := apiutils.ParseBool(os.Getenv(teleport.EnvVarUnstableDisableSAMLRedirectDowngradeCheck)); disableCheckRedirect {\n\t\t\tlog.DebugContext(ctx, \"Redirect HTTPS downgrade check disabled with the unstable environment variable\")\n\t\t} else {\n\t\t\tcheckRedirect = func(req *http.Request, via []*http.Request) error {\n\t\t\t\tif len(via) != 0 && strings.EqualFold(via[len(via)-1].URL.Scheme, \"https\") && !strings.EqualFold(req.URL.Scheme, \"https\") {\n\t\t\t\t\treturn errors.New(\"connection downgrade not allowed for URL: \" + req.URL.String())\n\t\t\t\t}\n\t\t\t\tif len(via) >= 10 {\n\t\t\t\t\treturn errors.New(\"stopped after 10 redirects\")\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t}\n\t\t}\n\n\t\thttpClient := &http.Client{\n\t\t\tCheckRedirect: checkRedirect,\n\t\t\tTransport:     params.Options.Transport,\n\t\t}\n\n\t\tctx, cancel := context.WithTimeout(ctx, defaults.DefaultIOTimeout)\n\t\tdefer cancel()\n\t\treq, err := http.NewRequestWithContext(ctx, \"GET\", url, nil)\n\t\tif err != nil {\n\t\t\treturn \"\", nil, trace.Wrap(err)","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/services/saml.go#L252-L288","documentation":"Returned by the SAML entity-descriptor fetcher's redirect policy: while following IdP metadata URLs, an HTTP redirect would downgrade the scheme (e.g. HTTPS to HTTP) and the proxy refuses to follow it to prevent leaking metadata requests over an insecure connection.","triggerScenarios":"Thrown at lib/services/saml.go:270 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the IdP's metadata/redirect URLs to stay on HTTPS","As a temporary diagnostic workaround, the environment variable Teleport uses to disable the SAML redirect downgrade check can be set, but the underlying IdP configuration should be corrected"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}