# SSO Login Redirect Loop **URL:** \ **Category:** Uncategorized\ **Created:** [August 15, 2024, 3:22pm UTC](https://support.prodi.gy/t/sso-login-redirect-loop/7327 "2024-08-15T15:22:00Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![laurejt](https://avatars.discourse-cdn.com/v4/letter/l/b19c9b/32.png) [@laurejt](https://support.prodi.gy/u/laurejt)\ **Post date:** [August 15, 2024, 3:22pm UTC](https://support.prodi.gy/t/sso-login-redirect-loop/7327/1 "2024-08-15T15:22:00Z")
We're trying to setup SSO using Microsoft Entra, but we've had difficulties troubleshooting. We've been following the [guide](https://prodi.gy/docs/sso) but it's less obvious to us where Auth0 diverges from Entra. Here are the relevant Prodigy `env` settings: ```python PRODIGY_OIDC_AUTH_ENABLED="1" PRODIGY_OIDC_DISCOVERY_URL= [entry_discovery_id] PRODIGY_OIDC_CLIENT_ID= [entra_app_id] PRODIGY_OIDC_CLIENT_SECRET= [entra_client_secret] PRODIGY_OIDC_REQUIRED_SCOPES="openid email" ``` We were originally getting a Bad Gateway Error when attempting to login which seemed to be caused by nginx rejecting the requests because the headers were too long. So, we modified `PRODIGY_OIDC_REQUIRED_SCOPES` as suggested [here](https://support.prodi.gy/t/307-temporary-redirect-during-login-callback-call-in-sso-prodigy-company/7149/5). Unfortunately, now we appear to be stuck in some kind of login loop. With the logs showing that we the following chain of redirects: ```python "GET / HTTP/1.0" 307 Temporary Redirect "GET /login HTTP/1.0" 307 Temporary Redirect "GET /login/callback?code=[...]&state=[...]&session_state=[...] HTTP/1.0" 307 Temporary Redirect "GET /?session=[...] HTTP/1.0" 307 Temporary Redirect ``` This seems to be suggesting that (1) the main page redirects to `/login`, (2) then redirects to `login/callback` on a successful login, (3) then redirects to a session, but then for some reason it then loops back to the `login` page as if the user hadn't been authenticated. What might be causing this issue? ---
**Author:** ![magdaaniol](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/magdaaniol/32/2787_2.png) [@magdaaniol](https://support.prodi.gy/u/magdaaniol)\ **Post date:** [August 17, 2024, 9:55am UTC](https://support.prodi.gy/t/sso-login-redirect-loop/7327/2 "2024-08-17T09:55:31Z")
Welcome to the forum @laurejt, There's not much difference really between Auth0 and Entra setup. I suspect it's more likely that the `nginx` might be adding the session ID only on the way to the server to the effect that the browser is not aware of session argument and considers the request unauthorized which would cause the authentication loop. Could you possibly test your Entra SSO setup without `nginx` in the middle? Just to confirm my initial hypothesis. Another test would be to copy and paste in the browser the URI with the session argument that appears in the logs (you'd need to prefix it with the base URL for your Prodigy instance): ```python "GET /?session=[...] HTTP/1.0" 307 Temporary Redirect ``` Thank you! ---
**Author:** ![rlskoeser](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/rlskoeser/32/4447_2.png) [@rlskoeser](https://support.prodi.gy/u/rlskoeser)\ **Post date:** [August 28, 2024, 4:14pm UTC](https://support.prodi.gy/t/sso-login-redirect-loop/7327/3 "2024-08-28T16:14:11Z")
Hi @magdaaniol, I'm working on this with @laurejt and we had some time together to do some more troubleshooting. Hoping you can advise on what might be going on or what to try next. To test without nginx in the loop, I used ssh with port forwarding and edited my local hosts file so that it answers to the domain name where we're testing Prodigy with SSO and which is configured in the MS Entra configuration. The only difference is that MS Entra is configured to use https and the way I'm accessing it cuts the https out of the loop. I'm manually editing redirected URLs in the browser when I'm sent to https - that may be introducing additional problems. When I test with this setup, bypassing nginx, here's the sequence of URLs reported by the Network panel in my browser: - `/login` (prodigy server) - `/authorize?response_type ...` (login.microsoft ...) - `/login/callback?code= ...` (prodigy server) The callback goes to https because that's what's configured in MS Entra. I tried configuring it to test on [http://localhost/](http://localhost/) but I can't get that to work either. We're not even getting to the session urls with this approach, and it still doesn't seem like the prodigy application registers us as being logged in. ---
**Author:** ![magdaaniol](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/magdaaniol/32/2787_2.png) [@magdaaniol](https://support.prodi.gy/u/magdaaniol)\ **Post date:** [September 2, 2024, 7:12am UTC](https://support.prodi.gy/t/sso-login-redirect-loop/7327/4 "2024-09-02T07:12:00Z")
Hi @rlskoeser, Next thing I was going to suggest is to try to set up Prodigy running locally i.e. http with a new test Entra app (that would accept http) but I'm not sure if you can do that within your org Entra account. I just wanted to check this way if the basic settings are correct and we are dealing with networking issues. Also maybe you could share the screenshots of your Entra configuration (if not here than on contact@explosion.ai) just to double check? If that doesn't work, it is probably best to have a support call? We'll DM you with Calendly link where you could book a slot. ---
**Author:** ![laurejt](https://avatars.discourse-cdn.com/v4/letter/l/b19c9b/32.png) [@laurejt](https://support.prodi.gy/u/laurejt)\ **Post date:** [September 19, 2024, 2:05pm UTC](https://support.prodi.gy/t/sso-login-redirect-loop/7327/5 "2024-09-19T14:05:03Z")
Thanks, @magdaaniol. I sent an email to contact@explosion.ai on Monday afternoon. Do you have a sense of how long it'll take to receive a response? ---
**Author:** ![magdaaniol](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/magdaaniol/32/2787_2.png) [@magdaaniol](https://support.prodi.gy/u/magdaaniol)\ **Post date:** [September 25, 2024, 7:30am UTC](https://support.prodi.gy/t/sso-login-redirect-loop/7327/6 "2024-09-25T07:30:59Z")
Hi @laurejt, Apologies for the delay. I believe @honnibal responded earlier this week. Hopefully we can get you up and running soon!