Restore GUI login

If you enter correct credentials but the Shturval platform GUI keeps redirecting you to the sign-in form, check the user token size and HTTP header size limits.

This situation can arise, for example, when the user is a member of a large number of LDAP groups (more than 100). In this case, the entire list of user groups ends up in the token, which makes the token too heavy. After successfully issuing a token, the browser passes it in HTTP headers, and the External Connection Control Module (shturval-ingress-controller) rejects the request if the header size is exceeded.

Diagnosis of the problem #

You can tell whether the redirect loop is caused by token size from these signs:

• in the authn logs, entries about successful user login are repeated;

kubectl -n shturval-backend logs deployments/authn --all-pods --all-containers

{"log_level":"INFO","time":"2026-05-07 12:02:03.261","message":"login","result":"success","from":"<ip-address>","request_id":"<request_id>","username":"<username>","token_id":"<token_id>"}
{"log_level":"INFO","time":"2026-05-07 12:02:04.284","message":"login","result":"success","from":"<ip-address>","request_id":"<request_id>","username":"<username>","token_id":"<token_id>"}
{"log_level":"INFO","time":"2026-05-07 12:02:05.309","message":"login","result":"success","from":"<ip-address>","request_id":"<request_id>","username":"<username>","token_id":"<token_id>"}

• in the shturval-ingress-controller logs there are messages about exceeding the permissible size of the HTTP header;

kubectl -n ingress logs deployments/shturval-ingress-controller-controller --all-pods --all-containers

[pod/shturval-ingress-controller-controller-866f94-q7z/controller] 2026/05/14 12:47:09 [info] 18663#18663: *client sent too large header field while processing HTTP/2 connection, client: <client>, server: <server>

• the user token is significantly larger than the established limit of 16 KB;
• the user is a member of a large number of LDAP groups (more than 100).

Solution #

If after diagnostics it is determined that GUI login is unavailable due to token weight, you can restore access by increasing the allowed size of HTTP headers in shturval-ingress-controller. To do this:

1. Prepare a ShturvalServicePatch for application to the External Connection Control Module specification (ssc) (shturval-ingress-controller), setting large-client-header-buffers to the required HTTP header size.

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: shturval-ingress-controller-large-headers
spec:
  shturvalServiceConfigName: shturval-ingress-controller
  customvalues:
    controller:
      config:
        large-client-header-buffers: "<your parameter value>"

2. In the management cluster, apply the prepared ShturvalServicePatch.

kubectl apply -f <ENTER-MANIFEST-FILENAME-ShturvalServicePatch>.yaml

3. Wait for the shturval-ingress-controller configuration to be applied.

4. Log in to the platform GUI.

After applying the setting, Ingress Controller will be able to accept requests with larger HTTP headers.