BerriAI/litellm · error · HTTPException

Invalid SP metadata: {', '.join(errors)}

Error message

Invalid SP metadata: {', '.join(errors)}

What it means

build_sp_metadata validates the generated SP metadata document with python3-saml; the toolkit reports validation errors, which are joined into this 500 detail. It means the proxy's own SP metadata could not be produced cleanly — typically a bad SP key/cert or entity id configuration.

Source

Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:277

                value=request_id,
                max_age=_SAML_AUTHN_REQUEST_TTL_SECONDS,
                httponly=True,
                secure=secure,
                samesite="none" if secure else "lax",
            )
        return response

    @staticmethod
    async def build_sp_metadata(request: Request, cache: DualCache) -> str:
        if not SAML_AVAILABLE:
            raise _saml_unavailable_error()
        idp_settings: Final = await SAMLAuthHandler._load_idp_settings(cache)
        settings: Final = SAMLAuthHandler._build_settings(request, idp_settings)
        saml_settings: Final = OneLogin_Saml2_Settings(settings, sp_validation_only=True)
        metadata: Final = cast(str, saml_settings.get_sp_metadata())  # cast-ok: untyped python3-saml
        errors: Final = cast(list[str], saml_settings.validate_metadata(metadata))  # cast-ok: untyped python3-saml
        if errors:
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                detail=f"Invalid SP metadata: {', '.join(errors)}",
            )
        return metadata

    @staticmethod
    async def read_acs_post_data(request: Request) -> dict[str, str]:
        """Read the ACS POST form under a hard size cap before any base64/XML decoding.

        Bounds both Content-Length-declared and chunked requests so an unauthenticated
        caller cannot force unbounded buffering while decoding the SAMLResponse."""
        declared: Final = request.headers.get("content-length")
        if declared is not None and declared.isdigit() and int(declared) > _SAML_MAX_POST_BYTES:
            raise HTTPException(
                status_code=status.HTTP_413_CONTENT_TOO_LARGE,
                detail="SAML response exceeds the maximum allowed size.",
            )

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Fix the SP metadata fields listed in the error.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:277 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/ada87b525f02c10a. Report an issue: GitHub.