gravitational/teleport · error

connection downgrade not allowed for URL:

Error message

connection downgrade not allowed for URL: 

What it means

Returned by the SAML entity-descriptor fetcher's redirect policy: while following IdP metadata URLs, an HTTP redirect would downgrade the scheme (e.g. HTTPS to HTTP) and the proxy refuses to follow it to prevent leaking metadata requests over an insecure connection.

Source

Thrown at lib/services/saml.go:270

			return
		}
		if params.MFA {
			log.ErrorContext(ctx, "Failed to fetch or parse SAML MFA entity descriptor", "error", err)
		} else {
			log.ErrorContext(ctx, "Failed to fetch or parse SAML entity descriptor", "error", err)
		}
		err = trace.Wrap(ErrFailedToFetchOrParseEntityDescriptor)
	}()

	if url != "" && !params.Options.NoFollowURLs {
		var checkRedirect func(req *http.Request, via []*http.Request) error
		// TODO(kopiczko): Remove this env var after Jul 2027 (one year since introduced) if no issue is reported.
		if disableCheckRedirect, _ := apiutils.ParseBool(os.Getenv(teleport.EnvVarUnstableDisableSAMLRedirectDowngradeCheck)); disableCheckRedirect {
			log.DebugContext(ctx, "Redirect HTTPS downgrade check disabled with the unstable environment variable")
		} else {
			checkRedirect = func(req *http.Request, via []*http.Request) error {
				if len(via) != 0 && strings.EqualFold(via[len(via)-1].URL.Scheme, "https") && !strings.EqualFold(req.URL.Scheme, "https") {
					return errors.New("connection downgrade not allowed for URL: " + req.URL.String())
				}
				if len(via) >= 10 {
					return errors.New("stopped after 10 redirects")
				}
				return nil
			}
		}

		httpClient := &http.Client{
			CheckRedirect: checkRedirect,
			Transport:     params.Options.Transport,
		}

		ctx, cancel := context.WithTimeout(ctx, defaults.DefaultIOTimeout)
		defer cancel()
		req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
		if err != nil {
			return "", nil, trace.Wrap(err)

View on GitHub (pinned to 1283425b60)

Solutions

1. Fix the IdP's metadata/redirect URLs to stay on HTTPS
2. As a temporary diagnostic workaround, the environment variable Teleport uses to disable the SAML redirect downgrade check can be set, but the underlying IdP configuration should be corrected

When it happens

Trigger: Thrown at lib/services/saml.go:270 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/0c38fd95cf89dc6e. Report an issue: GitHub.