BerriAI/litellm · error · HTTPException

SAML SSO is not configured. Set SAML_IDP_METADATA_URL or SAM

Error message

SAML SSO is not configured. Set SAML_IDP_METADATA_URL or SAML_IDP_METADATA_XML.

What it means

SAML login sentinel: _load_idp_settings finds neither SAML_IDP_METADATA_URL nor SAML_IDP_METADATA_XML in the environment, so the IdP cannot be configured and any SAML flow fails immediately with this error. At-fault condition is missing SSO environment configuration.

Source

Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:154

    @staticmethod
    def _acs_url(request: Request) -> str:
        return SAMLAuthHandler._base_url(request) + SAML_CALLBACK_ROUTE

    @staticmethod
    def _metadata_url(request: Request) -> str:
        return SAMLAuthHandler._base_url(request) + SAML_METADATA_ROUTE

    @staticmethod
    def _sp_entity_id(request: Request) -> str:
        return SAMLAuthHandler._env("SAML_SP_ENTITY_ID") or SAMLAuthHandler._metadata_url(request)

    @staticmethod
    async def _load_idp_settings(cache: DualCache) -> dict[str, object]:
        metadata_url: Final = SAMLAuthHandler._env("SAML_IDP_METADATA_URL")
        metadata_xml: Final = SAMLAuthHandler._env("SAML_IDP_METADATA_XML")
        source: Final = metadata_url or metadata_xml
        if source is None:
            raise HTTPException(
                status_code=status.HTTP_501_NOT_IMPLEMENTED,
                detail="SAML SSO is not configured. Set SAML_IDP_METADATA_URL or SAML_IDP_METADATA_XML.",
            )

        cache_key: Final = f"{_SAML_IDP_SETTINGS_CACHE_PREFIX}:{hashlib.sha256(source.encode()).hexdigest()}"
        cached: Final = cache.get_cache(key=cache_key)
        if isinstance(cached, dict):
            return cast(dict[str, object], cached)  # cast-ok: untyped python3-saml

        if metadata_url is not None:
            parsed = await asyncio.to_thread(
                OneLogin_Saml2_IdPMetadataParser.parse_remote,
                metadata_url,
                validate_cert=SAMLAuthHandler._bool_env("SAML_IDP_METADATA_VALIDATE_CERT", True),
                timeout=_SAML_METADATA_FETCH_TIMEOUT_SECONDS,
            )
        else:
            parsed = OneLogin_Saml2_IdPMetadataParser.parse(cast(str, metadata_xml))  # cast-ok: untyped python3-saml

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set SAML_IDP_METADATA_URL or SAML_IDP_METADATA_XML in the environment.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:154 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/962c27abd8da0f0e. Report an issue: GitHub.