gravitational/teleport · error

stopped after 10 redirects

Error message

stopped after 10 redirects

What it means

Returned by the SAML entity-descriptor fetcher when the IdP's metadata URL chain exceeds the hard limit of 10 HTTP redirects; the proxy stops following to avoid redirect loops when fetching the SAML metadata.

Source

Thrown at lib/services/saml.go:273

			log.ErrorContext(ctx, "Failed to fetch or parse SAML MFA entity descriptor", "error", err)
		} else {
			log.ErrorContext(ctx, "Failed to fetch or parse SAML entity descriptor", "error", err)
		}
		err = trace.Wrap(ErrFailedToFetchOrParseEntityDescriptor)
	}()

	if url != "" && !params.Options.NoFollowURLs {
		var checkRedirect func(req *http.Request, via []*http.Request) error
		// TODO(kopiczko): Remove this env var after Jul 2027 (one year since introduced) if no issue is reported.
		if disableCheckRedirect, _ := apiutils.ParseBool(os.Getenv(teleport.EnvVarUnstableDisableSAMLRedirectDowngradeCheck)); disableCheckRedirect {
			log.DebugContext(ctx, "Redirect HTTPS downgrade check disabled with the unstable environment variable")
		} else {
			checkRedirect = func(req *http.Request, via []*http.Request) error {
				if len(via) != 0 && strings.EqualFold(via[len(via)-1].URL.Scheme, "https") && !strings.EqualFold(req.URL.Scheme, "https") {
					return errors.New("connection downgrade not allowed for URL: " + req.URL.String())
				}
				if len(via) >= 10 {
					return errors.New("stopped after 10 redirects")
				}
				return nil
			}
		}

		httpClient := &http.Client{
			CheckRedirect: checkRedirect,
			Transport:     params.Options.Transport,
		}

		ctx, cancel := context.WithTimeout(ctx, defaults.DefaultIOTimeout)
		defer cancel()
		req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
		if err != nil {
			return "", nil, trace.Wrap(err)
		}
		resp, err := httpClient.Do(req)
		if err != nil {

View on GitHub (pinned to 1283425b60)

Solutions

1. Fix the IdP or intermediary to serve metadata with fewer redirect hops (point directly at the final metadata URL)
2. Check for a redirect loop in the IdP configuration

When it happens

Trigger: Thrown at lib/services/saml.go:273 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/6eee4bb595259f0c. Report an issue: GitHub.