SAML 2.0 authentication looping and never allowing login

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

After configuring SAML 2.0 authentication, OKTA in this case, accessing IDM will generate an IDM URL with a session token, but never logs into IDM, and you can observe the session information in the URL string being updated repeatedly. 

Environment

Identity Manager 14.x

Cause

In this case, the problem was due to IDM being a cluster behind a load balancer but pointing the "IM Proxy Base URL" at a specific IDM node instead of the overall Load Balancer URL.

Resolution

Changing the "IM Proxy Base URL" to the fully qualified Load Balancer address resolves this issue: