BerriAI/litellm · error · HTTPException

Unsolicited (IdP-initiated) SAML responses require a shared

Error message

Unsolicited (IdP-initiated) SAML responses require a shared Redis cache so the replay guard is enforced across every worker.

What it means

Unsolicited SAML is allowed, but the cache has no Redis backing (cache.redis_cache is None); the assertion-ID replay guard could then only be enforced per-worker, so the handler fails closed with 401 rather than accept a replayable response.

Source

Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:390

                    detail="SAML response references an unknown or already-used login request.",
                )
            if browser_request_id is None or not secrets.compare_digest(browser_request_id, in_response_to):
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
                    detail="SAML response is not bound to this browser's login request.",
                )
        elif browser_request_id is not None:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="SAML response is not bound to this browser's login request.",
            )
        elif not SAMLAuthHandler._bool_env("SAML_ALLOW_UNSOLICITED", False):
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Unsolicited (IdP-initiated) SAML responses are disabled.",
            )
        elif cache.redis_cache is None:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail=(
                    "Unsolicited (IdP-initiated) SAML responses require a shared Redis cache "
                    "so the replay guard is enforced across every worker."
                ),
            )

        assertion_id: Final = cast(str | None, auth.get_last_assertion_id())  # cast-ok: untyped python3-saml
        if assertion_id is None:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="SAML assertion is missing the required ID attribute.",
            )
        consumed_key: Final = f"{_SAML_CONSUMED_ASSERTION_CACHE_PREFIX}:{assertion_id}"
        consumed_count: Final = await cache.async_increment_cache(
            key=consumed_key, value=1, ttl=SAMLAuthHandler._replay_guard_ttl(auth)
        )
        if consumed_count is not None and consumed_count > 1:

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Configure a shared Redis cache for the proxy so the replay guard works across workers.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:390 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/eb8bbbfb38ed7147. Report an issue: GitHub.