BerriAI/litellm · error · HTTPException

Could not parse an IdP entityID/SSO URL/certificate from the

Error message

Could not parse an IdP entityID/SSO URL/certificate from the SAML metadata.

What it means

After fetching and parsing the IdP metadata (remote URL or inline XML), the resulting structure lacks an entityID, SSO URL, or certificate — i.e. the metadata source is unreachable-truncated or not valid IdP metadata — so the handler refuses to build SAML settings with this error.

Source

Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:176

        cache_key: Final = f"{_SAML_IDP_SETTINGS_CACHE_PREFIX}:{hashlib.sha256(source.encode()).hexdigest()}"
        cached: Final = cache.get_cache(key=cache_key)
        if isinstance(cached, dict):
            return cast(dict[str, object], cached)  # cast-ok: untyped python3-saml

        if metadata_url is not None:
            parsed = await asyncio.to_thread(
                OneLogin_Saml2_IdPMetadataParser.parse_remote,
                metadata_url,
                validate_cert=SAMLAuthHandler._bool_env("SAML_IDP_METADATA_VALIDATE_CERT", True),
                timeout=_SAML_METADATA_FETCH_TIMEOUT_SECONDS,
            )
        else:
            parsed = OneLogin_Saml2_IdPMetadataParser.parse(cast(str, metadata_xml))  # cast-ok: untyped python3-saml

        idp_settings: Final = cast(dict[str, object], parsed)  # cast-ok: untyped python3-saml
        if not idp_settings.get("idp"):
            raise HTTPException(
                status_code=status.HTTP_502_BAD_GATEWAY,
                detail="Could not parse an IdP entityID/SSO URL/certificate from the SAML metadata.",
            )
        cache.set_cache(key=cache_key, value=idp_settings, ttl=_SAML_IDP_METADATA_TTL_SECONDS)
        return idp_settings

    @staticmethod
    def _build_settings(request: Request, idp_settings: dict[str, object]) -> dict[str, object]:
        sp_settings: Final[dict[str, object]] = {
            "strict": SAMLAuthHandler._bool_env("SAML_STRICT", True),
            "debug": False,
            "sp": {
                "entityId": SAMLAuthHandler._sp_entity_id(request),
                "assertionConsumerService": {
                    "url": SAMLAuthHandler._acs_url(request),
                    "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
                },
                "NameIDFormat": SAMLAuthHandler._env(

View on GitHub (pinned to 77b7c6c40c)

Solutions

  1. Verify the IdP metadata contains an entityID, SSO URL, and signing certificate.
  2. Fetch the metadata URL manually to confirm it returns valid XML.
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:176 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/546d096eb94cc297. Report an issue: GitHub.