{"record":{"id":"546d096eb94cc297","repo":"BerriAI/litellm","slug":"could-not-parse-an-idp-entityid-sso-url-certificat","errorCode":null,"errorMessage":"Could not parse an IdP entityID/SSO URL/certificate from the SAML metadata.","messagePattern":"Could not parse an IdP entityID/SSO URL/certificate from the SAML metadata\\.","errorType":"http","errorClass":"HTTPException","httpStatus":502,"severity":"error","filePath":"litellm/proxy/management_endpoints/sso/saml_sso.py","lineNumber":176,"sourceCode":"\n        cache_key: Final = f\"{_SAML_IDP_SETTINGS_CACHE_PREFIX}:{hashlib.sha256(source.encode()).hexdigest()}\"\n        cached: Final = cache.get_cache(key=cache_key)\n        if isinstance(cached, dict):\n            return cast(dict[str, object], cached)  # cast-ok: untyped python3-saml\n\n        if metadata_url is not None:\n            parsed = await asyncio.to_thread(\n                OneLogin_Saml2_IdPMetadataParser.parse_remote,\n                metadata_url,\n                validate_cert=SAMLAuthHandler._bool_env(\"SAML_IDP_METADATA_VALIDATE_CERT\", True),\n                timeout=_SAML_METADATA_FETCH_TIMEOUT_SECONDS,\n            )\n        else:\n            parsed = OneLogin_Saml2_IdPMetadataParser.parse(cast(str, metadata_xml))  # cast-ok: untyped python3-saml\n\n        idp_settings: Final = cast(dict[str, object], parsed)  # cast-ok: untyped python3-saml\n        if not idp_settings.get(\"idp\"):\n            raise HTTPException(\n                status_code=status.HTTP_502_BAD_GATEWAY,\n                detail=\"Could not parse an IdP entityID/SSO URL/certificate from the SAML metadata.\",\n            )\n        cache.set_cache(key=cache_key, value=idp_settings, ttl=_SAML_IDP_METADATA_TTL_SECONDS)\n        return idp_settings\n\n    @staticmethod\n    def _build_settings(request: Request, idp_settings: dict[str, object]) -> dict[str, object]:\n        sp_settings: Final[dict[str, object]] = {\n            \"strict\": SAMLAuthHandler._bool_env(\"SAML_STRICT\", True),\n            \"debug\": False,\n            \"sp\": {\n                \"entityId\": SAMLAuthHandler._sp_entity_id(request),\n                \"assertionConsumerService\": {\n                    \"url\": SAMLAuthHandler._acs_url(request),\n                    \"binding\": \"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\",\n                },\n                \"NameIDFormat\": SAMLAuthHandler._env(","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/sso/saml_sso.py#L158-L194","documentation":"After fetching and parsing the IdP metadata (remote URL or inline XML), the resulting structure lacks an entityID, SSO URL, or certificate — i.e. the metadata source is unreachable-truncated or not valid IdP metadata — so the handler refuses to build SAML settings with this error.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:176 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the IdP metadata contains an entityID, SSO URL, and signing certificate.","Fetch the metadata URL manually to confirm it returns valid XML."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}