BerriAI/litellm · error · HTTPException

Invalid SAML configuration: {e}

Error message

Invalid SAML configuration: {e}

What it means

_build_auth wraps OneLogin_Saml2_Settings construction: any malformed combination of SP/IdP settings (bad cert format, mismatched URLs, bad entity ids) raises OneLogin_Saml2_Error, which is translated into this 500-class HTTPException naming the underlying cause.

Source

Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:237

            "get_data": dict(request.query_params),
            "post_data": post_data or {},
        }

    @staticmethod
    async def _build_auth(
        request: Request,
        cache: DualCache,
        post_data: dict[str, str] | None = None,
    ) -> "OneLogin_Saml2_Auth":
        if not SAML_AVAILABLE:
            raise _saml_unavailable_error()
        idp_settings: Final = await SAMLAuthHandler._load_idp_settings(cache)
        settings: Final = SAMLAuthHandler._build_settings(request, idp_settings)
        request_data: Final = SAMLAuthHandler._prepare_request_data(request, post_data)
        try:
            return OneLogin_Saml2_Auth(request_data, old_settings=settings)
        except Exception as e:  # noqa: BLE001 - toolkit exposes no common exception base; fail closed
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                detail=f"Invalid SAML configuration: {e}",
            )

    @staticmethod
    async def build_login_redirect(
        request: Request, cache: DualCache, relay_state: str | None = None
    ) -> RedirectResponse:
        auth: Final = await SAMLAuthHandler._build_auth(request, cache)
        redirect_url: Final = cast(str, auth.login(return_to=relay_state))  # cast-ok: untyped python3-saml
        response: Final = RedirectResponse(url=redirect_url, status_code=303)
        request_id: Final = cast(str | None, auth.get_last_request_id())  # cast-ok: untyped python3-saml
        if request_id is not None:
            cache.set_cache(
                key=f"{_SAML_AUTHN_REQUEST_CACHE_PREFIX}:{request_id}",
                value="1",
                ttl=_SAML_AUTHN_REQUEST_TTL_SECONDS,
            )

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Check the SAML configuration values (metadata, entity ids, certificates).
2. Check proxy logs for the underlying parse error.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:237 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/48ce59046c4acf24. Report an issue: GitHub.