Restore login to GUI

If, when logging into the GUI of the Shturval platform, you are faced with the problem of constant redirection to the authentication form when entering the correct credentials, check the size of the user token and the restrictions on the size of HTTP headers.

This situation may arise, for example, when the user is a member of a large number of LDAP groups (more than 100). In this case, the entire list of user groups ends up in the token, which makes the token too heavy. After successfully issuing a token, the browser passes it in HTTP headers, and the External Connection Control Module (shturval-ingress-controller) rejects the request if the header size is exceeded.

How to check the reason #

It is possible to understand whether a constant redirect to the authentication form is related to the weight of the token by the following signs:

1. Check authentication logs #

The authn logs contain repeated entries about successful user login.

kubectl -n shturval-backend logs deployments/authn --all-pods --all-containers

{"log_level":"INFO","time":"2026-05-07 12:02:03.261","message":"login","result":"success","from":"<ip-address>","request_id":"<request_id>","username":"<user_name>","token_id":"<token_id>"}
{"log_level":"INFO","time":"2026-05-07 12:02:04.284","message":"login","result":"success","from":"<ip-address>","request_id":"<request_id>","username":"<user_name>","token_id":"<token_id>"}
{"log_level":"INFO","time":"2026-05-07 12:02:05.309","message":"login","result":"success","from":"<ip-address>","request_id":"<request_id>","username":"<user_name>","token_id":"<token_id>"}

2. Check shturval-ingress-controller logs #

In the shturval-ingress-controller logs there are messages about exceeding the permissible size of the HTTP header.

kubectl -n ingress logs deployments/shturval-ingress-controller-controller --all-pods --all-containers

[pod/shturval-ingress-controller-controller-866f94-q7z/controller] 2026/05/14 12:47:09 [info] 18663#18663: *client sent too large header field while processing HTTP/2 connection, client: <client>, server: <server>

3. Check the token and LDAP groups #

Additional signs:

• the user token is significantly larger than the established limit of 16 KB;
• the user is a member of a large number of LDAP groups (more than 100).

How to restore access #

If after diagnostics it is determined that GUI login is unavailable due to token weight, you can restore access by increasing the allowed size of HTTP headers in shturval-ingress-controller. To do this:

Actions are performed in the management cluster

1. Prepare a ShturvalServicePatch for application to the External Connection Control Module specification (ssc) (shturval-ingress-controller), setting large-client-header-buffers to the required HTTP header size.

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: shturval-ingress-controller-large-headers
spec:
  shturvalServiceConfigName: shturval-ingress-controller
  custom values:
    controller:
      config:
        large-client-header-buffers: "<your parameter value>"

2. Apply the prepared ShturvalServicePatch.

kubectl apply -f <ENTER-FILE-NAME-WITH-MANIFEST-ShturvalServicePatch>.yaml

3. Wait for the shturval-ingress-controller configuration to be applied.

4. Log in to the platform GUI.