agent hit SSO login failure loop when accessing admin console

TL;DR

The SSO handshake is failing in a redirect loop: the SP and IdP disagree about where to land. Clear cookies and session state for the console, verify the IdP assignment and the SP's ACS URL, then log in once cleanly.

agent hit SSO login failure loop when accessing admin console

Use this when

• SSO login to an admin console loops endlessly.
• The browser bounces between IdP and console.
• The loop never resolves to an error page.

Not for this skill when

• Login fails once with an error. Read the error.
• The loop is in the agent's own retry logic. Fix the agent.
• Only the agent's browser loops. Check extensions and profiles.

Steps

1. Clear cookies and session state for the console domain. Verify: the state is clean.
2. Verify the user is assigned to the app in the IdP. Verify: assignment exists.
3. Verify the SP's ACS URL matches the IdP config exactly. Verify: no character-level mismatch.
4. Log in fresh in a clean session. Verify: one login attempt.
5. Confirm access to the console. Verify: the session holds.

Variant phrasings

SSO redirect loop

The short phrasing.

login loop admin console

The page-first search.

SAML loop

The protocol-first phrasing.

Compatibility: Any SAML or OIDC SSO to an admin console.

Why it happens

Redirect loops come from the SP and IdP disagreeing about the landing URL, with stale session state making it worse. Each side redirects to the other, forever.

Edge cases / pitfalls

• The loop only in one browser profile; an extension is usually the cause.
• The IdP session itself being the broken piece; clear IdP cookies too.
• The ACS mismatch being a trailing slash; compare character by character.
• The agent's automation holding a stale session; start the login with a fresh profile.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xyLw6r26mqrMQ0YCY0r-Lg