SigNoz/signoz · error · errors.Error

CodeInvalidInput

CodeInvalidInput

Error message

saml: invalid email

What it means

parseMetricsDuration first tries to interpret the string as a float number of seconds; if that float times 1e9 overflows int64 it returns this overflow error instead of silently wrapping. It guards time.Duration (nanoseconds int64) against values beyond ~292 years.

Source

Thrown at ee/authn/callbackauthn/samlcallbackauthn/authn.go:101

	if err != nil {
		if errors.As(err, &saml2.ErrVerification{}) {
			return nil, errors.New(errors.TypeForbidden, errors.CodeForbidden, err.Error())
		}

		if errors.As(err, &saml2.ErrMissingElement{}) {
			return nil, errors.New(errors.TypeNotFound, errors.CodeNotFound, err.Error())
		}

		return nil, err
	}

	if assertionInfo.WarningInfo.InvalidTime {
		return nil, errors.New(errors.TypeForbidden, errors.CodeForbidden, "saml: expired saml response")
	}

	email, err := valuer.NewEmail(assertionInfo.NameID)
	if err != nil {
		return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "saml: invalid email").WithAdditional("The nameID assertion is used to retrieve the email address, please check your IDP configuration and try again.")
	}

	name := ""
	if nameAttribute := samlConfig.AttributeMapping.Name; nameAttribute != "" {
		if val := assertionInfo.Values.Get(nameAttribute); val != "" {
			name = val
		}
	}

	var groups []string
	if groupAttribute := samlConfig.AttributeMapping.Groups; groupAttribute != "" {
		groups = assertionInfo.Values.GetAll(groupAttribute)
	}

	role := ""
	if roleAttribute := samlConfig.AttributeMapping.Role; roleAttribute != "" {
		if val := assertionInfo.Values.Get(roleAttribute); val != "" {
			role = val

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Send durations in human Prometheus form ('1h', '5m', '30s') or as modest numeric seconds
2. Fix unit confusion: divide nanosecond values by 1e9 before sending
3. Cap/validate duration client-side to something sane (< 292 years) before calling the API

Example fix

# before
curl '.../api/v1/query_range?step=1704067200000000000&...'

# after
curl '.../api/v1/query_range?step=60&...'

func validDuration(s string) bool {
	if d, err := strconv.ParseFloat(s, 64); err == nil && math.Abs(d) < 9.2e18/1e9 { return true }
	if _, err := prommodel.ParseDuration(s); err == nil { return true }
	return false
}

null

null

When it happens

Trigger: Passing step= or a duration parameter whose numeric interpretation overflows: extremely large epoch-nanosecond values (e.g. using nanosecond epochs like 1704067200000000000 where seconds are expected), or strings like '1e300' that ParseFloat accepts.

Common situations: Sending nanosecond-precision timestamps where second-based durations are expected; unit confusion between ms/s/ns; generated queries multiplying step by a large factor; defensive tests feeding absurd values.

Related errors

• CodeLicenseUnavailable
• CodeForbidden
• CodeLicenseUnavailable
• CodeInvalidInput
• CodeForbidden

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/131d142f40226956. Report an issue: GitHub.