{"record":{"id":"526edb217d378aad","repo":"BerriAI/litellm","slug":"could-not-process-saml-response-e","errorCode":null,"errorMessage":"Could not process SAML response: {e}","messagePattern":"Could not process SAML response: (.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/sso/saml_sso.py","lineNumber":314,"sourceCode":"        body = bytearray()\n        async for chunk in request.stream():\n            body += chunk\n            if len(body) > _SAML_MAX_POST_BYTES:\n                raise HTTPException(\n                    status_code=status.HTTP_413_CONTENT_TOO_LARGE,\n                    detail=\"SAML response exceeds the maximum allowed size.\",\n                )\n\n        return dict(parse_qsl(body.decode(\"utf-8\", \"replace\")))\n\n    @staticmethod\n    async def handle_acs(request: Request, cache: DualCache, post_data: dict[str, str]) -> CustomOpenID:\n        auth: Final = await SAMLAuthHandler._build_auth(request, cache, post_data=post_data)\n        browser_request_id: Final = request.cookies.get(_SAML_AUTHN_STATE_COOKIE)\n        try:\n            auth.process_response(request_id=browser_request_id)\n        except Exception as e:  # noqa: BLE001 - toolkit exposes no common exception base; fail closed\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=f\"Could not process SAML response: {e}\",\n            )\n\n        errors: Final = cast(list[str], auth.get_errors())  # cast-ok: untyped python3-saml\n        if errors or not auth.is_authenticated():\n            reason: Final = auth.get_last_error_reason()\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=f\"SAML authentication failed: {reason or ', '.join(errors)}\",\n            )\n\n        await SAMLAuthHandler._enforce_response_binding(auth, cache, browser_request_id)\n        return SAMLAuthHandler._result_from_auth(auth)\n\n    @staticmethod\n    def _replay_guard_ttl(auth: \"OneLogin_Saml2_Auth\") -> int:\n        not_on_or_after: Final = auth.get_last_assertion_not_on_or_after()","sourceCodeStart":296,"sourceCodeEnd":332,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/sso/saml_sso.py#L296-L332","documentation":"handle_acs wraps auth.process_response(): any exception raised by the SAML toolkit while consuming the response (malformed XML, signature failures, decoding errors) is converted into this HTTPException so the browser login fails with a diagnosable message.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:314 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check proxy logs for the underlying SAML processing error.","Verify IdP/SP certificates and clock skew."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}