Request-URI Too Long to /authorize endpoint (Okta as IdP)

Hello again!

still trying to setup Oauth based PoC with Okta IdP, envoy.filters.http.ext_authz and eas.

Faced following problem with Okta, which is self explanatory:

Request-URI Too Long
The requested URL's length exceeds the capacity limit for this server.

Example request:

https://zztop.oktapreview.com/oauth2/aus1nDrtgu349y9mX0x7/v1/authorize?client_id=0oa1nt2v8y7E.....

The request to /authorize endpoint is 8000+ characters. Okta documentation is confusing and there are different limits for requests. Already raised ticket to Okta support to find out limit for request to /authorize endpoint in oauth flow case.

Still curious. Is it possible to deal such things in alternative way? Like smaller pointers, so the actual request to Okta /authorize endpoint is compact, etc.

Can this help? https://github.com/travisghansen/external-auth-server/blob/e4646e151ca9062e0ace68b748fcd8d7c9c7471c/CONFIG_TOKENS.md

Thank you!

[travisghansen]

Sounds good! I’m going to work on supporting ssl directly as L7 proxy in front of eas can result in some weird/unintentional behaviors for sure.

[nonefaken]

ok it is because of extensions.filters.http.ext_authz.v3.ExtAuthz. I just force added “X-Forwarded-Proto” header in it instead of “routes:”.

Im sorry i will continue to bug you, as my next step is to figure out how to plug “envoy.filters.http.jwt_authn” and “envoy.filters.http.rbac” to the whole concept, so it is possible to implement RBAC based on group claims in JWT tokens.

Thank you very much for help. Again, very interesting project!