BerriAI/litellm · error · HTTPException

SAML response exceeds the maximum allowed size.

Error message

SAML response exceeds the maximum allowed size.

What it means

read_acs_post_data streams the ACS POST body and enforces a size cap (_SAML_MAX_POST_BYTES); a SAML response larger than the cap is rejected with 413 before parsing, defending against oversized/malicious POSTs to the assertion consumer endpoint.

Source

Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:291

        saml_settings: Final = OneLogin_Saml2_Settings(settings, sp_validation_only=True)
        metadata: Final = cast(str, saml_settings.get_sp_metadata())  # cast-ok: untyped python3-saml
        errors: Final = cast(list[str], saml_settings.validate_metadata(metadata))  # cast-ok: untyped python3-saml
        if errors:
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                detail=f"Invalid SP metadata: {', '.join(errors)}",
            )
        return metadata

    @staticmethod
    async def read_acs_post_data(request: Request) -> dict[str, str]:
        """Read the ACS POST form under a hard size cap before any base64/XML decoding.

        Bounds both Content-Length-declared and chunked requests so an unauthenticated
        caller cannot force unbounded buffering while decoding the SAMLResponse."""
        declared: Final = request.headers.get("content-length")
        if declared is not None and declared.isdigit() and int(declared) > _SAML_MAX_POST_BYTES:
            raise HTTPException(
                status_code=status.HTTP_413_CONTENT_TOO_LARGE,
                detail="SAML response exceeds the maximum allowed size.",
            )

        body = bytearray()
        async for chunk in request.stream():
            body += chunk
            if len(body) > _SAML_MAX_POST_BYTES:
                raise HTTPException(
                    status_code=status.HTTP_413_CONTENT_TOO_LARGE,
                    detail="SAML response exceeds the maximum allowed size.",
                )

        return dict(parse_qsl(body.decode("utf-8", "replace")))

    @staticmethod
    async def handle_acs(request: Request, cache: DualCache, post_data: dict[str, str]) -> CustomOpenID:
        auth: Final = await SAMLAuthHandler._build_auth(request, cache, post_data=post_data)

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Reduce the SAML response size (e.g., fewer group claims) or configure the IdP to send a smaller assertion.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:291 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/2b00b2da0d4df637. Report an issue: GitHub.