BerriAI/litellm · error · HTTPException

Could not process SAML response: {e}

Error message

Could not process SAML response: {e}

What it means

handle_acs wraps auth.process_response(): any exception raised by the SAML toolkit while consuming the response (malformed XML, signature failures, decoding errors) is converted into this HTTPException so the browser login fails with a diagnosable message.

Source

Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:314

        body = bytearray()
        async for chunk in request.stream():
            body += chunk
            if len(body) > _SAML_MAX_POST_BYTES:
                raise HTTPException(
                    status_code=status.HTTP_413_CONTENT_TOO_LARGE,
                    detail="SAML response exceeds the maximum allowed size.",
                )

        return dict(parse_qsl(body.decode("utf-8", "replace")))

    @staticmethod
    async def handle_acs(request: Request, cache: DualCache, post_data: dict[str, str]) -> CustomOpenID:
        auth: Final = await SAMLAuthHandler._build_auth(request, cache, post_data=post_data)
        browser_request_id: Final = request.cookies.get(_SAML_AUTHN_STATE_COOKIE)
        try:
            auth.process_response(request_id=browser_request_id)
        except Exception as e:  # noqa: BLE001 - toolkit exposes no common exception base; fail closed
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail=f"Could not process SAML response: {e}",
            )

        errors: Final = cast(list[str], auth.get_errors())  # cast-ok: untyped python3-saml
        if errors or not auth.is_authenticated():
            reason: Final = auth.get_last_error_reason()
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail=f"SAML authentication failed: {reason or ', '.join(errors)}",
            )

        await SAMLAuthHandler._enforce_response_binding(auth, cache, browser_request_id)
        return SAMLAuthHandler._result_from_auth(auth)

    @staticmethod
    def _replay_guard_ttl(auth: "OneLogin_Saml2_Auth") -> int:
        not_on_or_after: Final = auth.get_last_assertion_not_on_or_after()

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Check proxy logs for the underlying SAML processing error.
2. Verify IdP/SP certificates and clock skew.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:314 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/526edb217d378aad. Report an issue: GitHub.