{"record":{"id":"48cae393da23bede","repo":"twentyhq/twenty","slug":"no-singlesignonservice-with-http-redirect-or-http","errorCode":null,"errorMessage":"No SingleSignOnService with HTTP-Redirect or HTTP-POST binding was found","messagePattern":"No SingleSignOnService with HTTP-Redirect or HTTP-POST binding was found","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/twenty-front/src/modules/settings/security/utils/parseSAMLMetadataFromXMLFile.ts","lineNumber":115,"sourceCode":"    const singleSignOnServices = getAllByPrefixAndKey(\n      IDPSSODescriptor,\n      'SingleSignOnService',\n    ).map((service) => ({\n      binding: service.getAttribute('Binding'),\n      location: service.getAttribute('Location'),\n    }));\n\n    // Prefer HTTP-Redirect (the default authnRequestBinding on the SP side),\n    // fall back to HTTP-POST since both are valid SAML 2.0 bindings and many\n    // IdPs (e.g. JumpCloud) only advertise HTTP-POST.\n    const ssoUrl =\n      singleSignOnServices.find((s) => s.binding === HTTP_REDIRECT_BINDING)\n        ?.location ??\n      singleSignOnServices.find((s) => s.binding === HTTP_POST_BINDING)\n        ?.location;\n\n    if (!ssoUrl) {\n      throw new Error(\n        'No SingleSignOnService with HTTP-Redirect or HTTP-POST binding was found',\n      );\n    }\n\n    const result = {\n      ssoUrl,\n      certificate: x509Certificate,\n      entityID: entityDescriptor?.getAttribute('entityID'),\n    };\n\n    return { success: true, data: validator.parse(result) };\n  } catch (error) {\n    return { success: false, reason: formatErrorReason(error) };\n  }\n};\n","sourceCodeStart":97,"sourceCodeEnd":131,"githubUrl":"https://github.com/twentyhq/twenty/blob/1f5dd2bbd2a8da3419c8cfd52dd545c0024df1a6/packages/twenty-front/src/modules/settings/security/utils/parseSAMLMetadataFromXMLFile.ts#L97-L131","documentation":"Thrown after IDPSSODescriptor is parsed: none of its <SingleSignOnService> entries carry a Binding attribute equal to the SAML HTTP-Redirect or HTTP-POST binding URN. Twenty only accepts these two standard SSO bindings for the authn request.","triggerScenarios":"IdP advertises only SOAP/Artifact/PAOS bindings for SingleSignOnService. The Binding attribute is missing or mistyped on every service entry. Bindings use a different (non-2.0) URI string.","commonSituations":"Testing IdP (e.g., a stub) that lacks HTTP-Redirect/POST endpoints. Enterprise IdP locked to SOAP-Artifact. Metadata generated by a misconfigured tool that drops Binding attributes.","solutions":["Open the XML and list all SingleSignOnService Binding values.","Reconfigure the IdP to advertise at least one HTTP-Redirect or HTTP-POST SSO endpoint.","If the binding URN is subtly different (e.g., wrong version string), correct it to urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect or HTTP-POST."],"exampleFix":"// before: <md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:SOAP\" Location=\"...\"/>\n// after:  <md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"...\"/>","handlingStrategy":"validation","validationCode":"const SSO_BINDINGS = new Set([\n  'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',\n  'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',\n]);\nconst listSsoBindings = (xml: string): string[] => {\n  const doc = new DOMParser().parseFromString(xml, 'application/xml');\n  return Array.from(doc.getElementsByTagName('SingleSignOnService'))\n    .map((el) => el.getAttribute('Binding') ?? '');\n};\n// guard: if (!listSsoBindings(xml).some((b) => SSO_BINDINGS.has(b))) showError(...);","typeGuard":"const metadataHasUsableSsoBinding = (xml: string): boolean =>\n  listSsoBindings(xml).some((b) => SSO_BINDINGS.has(b));","tryCatchPattern":"const res = parseSAMLMetadataFromXMLFile(xml);\nif (!res.success && res.reason.includes('SingleSignOnService')) {\n  notifyUser('IdP must advertise an HTTP-Redirect or HTTP-POST SSO endpoint');\n}","preventionTips":["Before upload, confirm the IdP exposes HTTP-POST (the most widely supported binding).","If only SOAP/Artifact is available, reconfigure the IdP to add HTTP-POST."],"tags":["saml","sso","xml","enterprise","validation"],"backgroundTag":null,"analyzedSha":"1f5dd2bbd2a8da3419c8cfd52dd545c0024df1a6","analyzedAt":"2026-08-12T15:37:27.593Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}