Problem Encountered

After setting up SSO, users receive a 401 HTTP status code and are sometimes put into a login loop where after inputting the tenant name, they are brought to the same login page as shown below:

Root Cause

The issue is typically in that the IDP returns too many group claims in the SAML/OIDC token, causing the session JWT to exceed the browser cookie limit, and then the cookie write fails and the user is bounced back to the login page. 

Solution

To resolve the login issue with Endor, limit what's sent in the groups claim to only the groups that correspond to the Endor auth-policies. This should allow the JWT to shrink below the cookie limits, and the login loop should disappear. 

After this change, confirm with users that they are able to successfully login via SSO.

If the issue persists after the change, and the JWT size looks normal, the next step is to verify other required claims such as email, name, or the expected group claim key/value mapping.

Additional Resources

• Microsoft Entra Docs

• Okta KB Article

Validating the Root cause

Follow these steps to confirm that the JWT size is causing the issue.

Step 1: Retrieve the JWT used during SSO

Please open the following URL in the same browser/profile where you are testing SSO:

https://api.endorlabs.com/v1/auth/sso?tenant={tenant_name}&redirect=headless

Replace {tenant_name} with your actual Endor Labs tenant name.

After signing in through your IdP, the browser should redirect to a simple page that displays the JWT returned during the SSO flow.

Step 2: Check the JWT size locally

Copy the full JWT and measure its size locally.

Mac / Linux

TOKEN='paste_the_full_jwt_here'
printf "%s" "$TOKEN" | wc -c

Python

token = "paste_the_full_jwt_here"
print(len(token.encode("utf-8")))

If the result is over approximately 4 KB, that is very likely the issue.

Step 3: Decode the JWT locally

You can also decode the JWT payload locally to inspect which claims are being sent.

Python

import base64, json

token = "paste_the_full_jwt_here"
header_b64, payload_b64, signature_b64 = token.split(".")

def b64url_decode(s):
    s += "=" * (-len(s) % 4)
    return base64.urlsafe_b64decode(s)

payload = json.loads(b64url_decode(payload_b64))
print(json.dumps(payload, indent=2))

When reviewing the decoded payload, please check for:

• a very large groups claim

• many group or role-related attributes

• duplicated or overly broad group membership data

The most common root cause is that the IdP is returning too many groups to Endor Labs.