{"record":{"id":"6eee4bb595259f0c","repo":"gravitational/teleport","slug":"stopped-after-10-redirects","errorCode":null,"errorMessage":"stopped after 10 redirects","messagePattern":"stopped after 10 redirects","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/services/saml.go","lineNumber":273,"sourceCode":"\t\t\tlog.ErrorContext(ctx, \"Failed to fetch or parse SAML MFA entity descriptor\", \"error\", err)\n\t\t} else {\n\t\t\tlog.ErrorContext(ctx, \"Failed to fetch or parse SAML entity descriptor\", \"error\", err)\n\t\t}\n\t\terr = trace.Wrap(ErrFailedToFetchOrParseEntityDescriptor)\n\t}()\n\n\tif url != \"\" && !params.Options.NoFollowURLs {\n\t\tvar checkRedirect func(req *http.Request, via []*http.Request) error\n\t\t// TODO(kopiczko): Remove this env var after Jul 2027 (one year since introduced) if no issue is reported.\n\t\tif disableCheckRedirect, _ := apiutils.ParseBool(os.Getenv(teleport.EnvVarUnstableDisableSAMLRedirectDowngradeCheck)); disableCheckRedirect {\n\t\t\tlog.DebugContext(ctx, \"Redirect HTTPS downgrade check disabled with the unstable environment variable\")\n\t\t} else {\n\t\t\tcheckRedirect = func(req *http.Request, via []*http.Request) error {\n\t\t\t\tif len(via) != 0 && strings.EqualFold(via[len(via)-1].URL.Scheme, \"https\") && !strings.EqualFold(req.URL.Scheme, \"https\") {\n\t\t\t\t\treturn errors.New(\"connection downgrade not allowed for URL: \" + req.URL.String())\n\t\t\t\t}\n\t\t\t\tif len(via) >= 10 {\n\t\t\t\t\treturn errors.New(\"stopped after 10 redirects\")\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t}\n\t\t}\n\n\t\thttpClient := &http.Client{\n\t\t\tCheckRedirect: checkRedirect,\n\t\t\tTransport:     params.Options.Transport,\n\t\t}\n\n\t\tctx, cancel := context.WithTimeout(ctx, defaults.DefaultIOTimeout)\n\t\tdefer cancel()\n\t\treq, err := http.NewRequestWithContext(ctx, \"GET\", url, nil)\n\t\tif err != nil {\n\t\t\treturn \"\", nil, trace.Wrap(err)\n\t\t}\n\t\tresp, err := httpClient.Do(req)\n\t\tif err != nil {","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/services/saml.go#L255-L291","documentation":"Returned by the SAML entity-descriptor fetcher when the IdP's metadata URL chain exceeds the hard limit of 10 HTTP redirects; the proxy stops following to avoid redirect loops when fetching the SAML metadata.","triggerScenarios":"Thrown at lib/services/saml.go:273 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the IdP or intermediary to serve metadata with fewer redirect hops (point directly at the final metadata URL)","Check for a redirect loop in the IdP configuration"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}