BerriAI/litellm · error · HTTPException

SAML assertion contained an invalid subject or email: {e}

Error message

SAML assertion contained an invalid subject or email: {e}

What it means

Constructing the final CustomOpenID from the validated SAML subject/email triggered a pydantic ValidationError (e.g. malformed email or identity fields failing model constraints). The exception is converted into an HTTPException so the browser gets a clear 4xx instead of a stack trace.

Source

Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:469

        verbose_proxy_logger.info(
            "SAML login: subject=%s, email=%s, attributes=%s", user_id, email, list(attributes.keys())
        )

        try:
            return CustomOpenID(
                id=user_id,
                email=email,
                first_name=first_name,
                last_name=last_name,
                display_name=display_name,
                picture=None,
                provider="saml",
                team_ids=team_ids,
                user_role=get_litellm_user_role(role_value) if role_value else None,
            )
        except ValidationError as e:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail=f"SAML assertion contained an invalid subject or email: {e}",
            )

    @staticmethod
    def _attribute_value(
        attributes: dict[str, list[str]],
        env_override: str,
        candidates: tuple[str, ...],
    ) -> str | None:
        values: Final = SAMLAuthHandler._attribute_values(attributes, env_override, candidates)
        return values[0] if values else None

    @staticmethod
    def _attribute_values(
        attributes: dict[str, list[str]],
        env_override: str,
        candidates: tuple[str, ...],

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Fix the subject/email attribute format in the IdP assertion.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:469 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/ffffe96401224984. Report an issue: GitHub.