{"record":{"id":"8a41b86f96761ff1","repo":"wpscanteam/wpscan","slug":"saml-authentication-is-required-to-access-this-res-8a41b8","errorCode":null,"errorMessage":"SAML authentication is required to access this resource, consider using --expect-saml.","messagePattern":"SAML authentication is required to access this resource, consider using --expect-saml\\.","errorType":"exception","errorClass":"WPScan::Error::SAMLAuthenticationRequired","httpStatus":null,"severity":"error","filePath":"app/controllers/core.rb","lineNumber":113,"sourceCode":"        return true if effective_uri.to_s.match?(/[?&]SAMLRequest/i)\n\n        # SAML flows often bounce through intermediate pages before the IdP;\n        # walk the redirect chain to catch a SAMLRequest in any Location header.\n        !!homepage_res&.redirections&.any? do |redirect_response|\n          redirect_response.headers['Location']&.match?(/SAMLRequest/i)\n        end\n      end\n\n      # Drives an interactive SAML login via a headless browser, injects the\n      # resulting session cookies into the shared Browser, and clears the target's\n      # cached homepage so the rest of the scan runs against the authenticated session.\n      #\n      # @param [ Addressable::URI ] effective_uri  URL that triggered the SAML redirect\n      #\n      # @return [ Void ]\n      def handle_saml_authentication(effective_uri)\n        raise Error::SAMLAuthenticationFailed if WPScan::ParsedCli.cookie_string && !WPScan::ParsedCli.expect_saml\n        raise Error::SAMLAuthenticationRequired unless WPScan::ParsedCli.expect_saml\n\n        new_cookies = BrowserAuthenticator.authenticate(effective_uri.to_s)\n\n        browser = WPScan::Browser.instance\n        browser.cookie_string = [browser.cookie_string, new_cookies].compact.reject(&:empty?).join('; ')\n\n        # Discard the pre-auth homepage so subsequent finders refetch with the new cookies.\n        target.reset_homepage_cache!\n\n        @saml_authenticated = true\n      end\n\n      # Checks for redirects; an out-of-scope redirect raises Error::HTTPRedirect.\n      #\n      # @param [ Typhoeus::Response ] res\n      def handle_redirection(res)\n        effective_url = target.homepage_res.effective_url # get and follow location of target.url\n        effective_uri = Addressable::URI.parse(effective_url)","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/wpscanteam/wpscan/blob/62c9cef471de90095f6b42245a11d0f8172d19c9/app/controllers/core.rb#L95-L131","documentation":"Raised by Core#handle_saml_authentication (app/controllers/core.rb:113) when a SAMLRequest is detected in the response or its redirect chain (Core#saml_request?) but --expect-saml was not given. It signals that the target sits behind a SAML identity provider and WPScan will not attempt the interactive headless-browser login unless you opt in with --expect-saml.","triggerScenarios":"Plain `wpscan --url https://target` (no --expect-saml, no --cookie-string) where the homepage 302s to an IdP URL containing a SAMLRequest parameter, or any intermediate Location header in homepage_res.redirections matches /SAMLRequest/i.","commonSituations":"Corporate/intranet WordPress behind ADFS, Okta, Azure AD/Entra or Keycloak SSO; staging sites recently put behind SSO; scanning from a machine whose SSO session has expired.","solutions":["Re-run with --expect-saml: WPScan opens a browser window, you complete the login, press enter, and the resulting cookies are injected into the scan","Ensure the run can support interactive auth: Chrome/Chromium on PATH and a real TTY (BrowserAuthenticator raises otherwise)","Alternative: log in manually in a browser and pass the session with --cookie-string instead of --expect-saml"],"exampleFix":"# before\nwpscan --url https://sso-protected.example.com\n# => SAML authentication is required ... consider using --expect-saml.\n\n# after\nwpscan --url https://sso-protected.example.com --expect-saml","handlingStrategy":"validation","validationCode":"# Detect the SAML redirect chain before launching the scan\nres = Typhoeus.get(url, followlocation: true)\nhas_saml = res.effective_url.match?(/[?&]SAMLRequest/i) ||\n           res.redirections.any? { |r| r.headers['Location'].to_s.match?(/SAMLRequest/i) }\nARGV.push('--expect-saml') if has_saml","typeGuard":null,"tryCatchPattern":"begin\n  scan.run\nrescue WPScan::Error::SAMLAuthenticationRequired\n  retry with '--expect-saml' appended (requires a TTY and Chrome/Chromium)\nend","preventionTips":["Always pass --expect-saml up front for SSO-protected targets","Keep Chrome/Chromium on PATH for the Ferrum-driven login","Run wpscan from a real shell (TTY) when interactive auth may be needed","--expect-saml on a non-SAML site is harmless: it prints 'expected but not required'"],"tags":["saml","sso","authentication","redirect"],"backgroundTag":"saml-authentication-required","analyzedSha":"62c9cef471de90095f6b42245a11d0f8172d19c9","analyzedAt":"2026-08-21T17:10:47.902Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}