web redirect for SSO

I have a site that when you go direct to it, it avoids our SSO tool. I want to redirect from the main URL to the SSO url, but once it has been redirected the host needs to be the same.

Example:

https://pam.example.com/ can avoid SSO - needs to redirect

https://example.okta.com/home/blah/blah/blah

which then goes back to

https://pam.example.com/WebConsole/blah/blah

My rule redirects properly at first, but then grabs and redirects the URL after the SSO sign in again, causing a 404. How can I stop it the subsequent times?

Code:

when HTTP_REQUEST {
    if { [string tolower [HTTP::host]] equals "pam.example.com" and 
([HTTP::uri] equals "/")} {
        HTTP::redirect "https://example.okta.com/home/example/0oaiosmzv7n2Qipud0x7/alniossou1CNshx5S0x7[HTTP::uri]"
    }
}