549 Authentication Gateway Error

The 549 Authentication Gateway Error status code is returned by Akamai EAA when the login POP cannot reach the directory backend during the authentication flow.

Table of Contents

Usage

Akamai EAA returns 549 when the login POP (point of presence) fails to communicate with the Authentication backend during the login flow. The login POP acts as a gateway between the user and the directory service (Active Directory, LDAP, or a cloud identity provider). When the gateway path breaks, authentication stalls and the user receives 549.

Common causes include:

  • The directory endpoint is unreachable from the login POP.
  • The management POP is unreachable, preventing the login POP from retrieving directory configuration.
  • The broker service connecting the login POP to on-premises directories through the connector is inaccessible.

The error is intermittent when caused by transient network issues between Akamai infrastructure components. A consistent 549 points to a persistent connectivity or configuration failure.

SEO impact

Search engines treat 549 responses as server errors. Persistent errors cause crawlers to reduce crawl frequency and eventually drop affected URLs from the index.

Example

A client attempts to access an EAA-protected application. The data POP Redirects to the login flow, but the login POP fails to reach the directory service.

Request

POST /auth/login HTTP/1.1
Host: login.example.re
Content-Type: application/x-www-form-urlencoded

username=jdoe&password=••••••••

Response

HTTP/1.1 549 Authentication Gateway Error
Content-Type: text/html

<html>
<head>
<title>Authentication Gateway Error</title>
</head>
<body>
<h1>549 Authentication Gateway Error</h1>
<p>The login service is unable to reach the
directory to complete authentication.</p>
</body>
</html>

How to fix

Check connector health in the EAA management portal. The connector bridges the login POP to on-premises directories. A connector in an unhealthy or disconnected state severs the directory path.

Verify the directory service is running and reachable from the connector. Test LDAP or LDAPS connectivity from the connector host:

openssl s_client -connect dc.corp.example.re:636

Confirm DNS resolution works for the directory hostname from the connector's network. Broken DNS is a frequent cause of intermittent 549 errors.

Review the login service error logs in the EAA management portal. Use the X-Ray-ID from the error response to trace the specific request through Akamai's logging pipeline and identify the exact failure point.

Inspect the agent logs on the connector for connection timeouts or TLS handshake failures to the management POP. A firewall blocking outbound port 443 from the connector disrupts the management channel.

For intermittent failures, increase the number of dial-out connections from the connector to the data POP to improve resilience against temporary network drops.

See also

Last updated: August 11, 2026