{"record":{"id":"a6982cfc1eeed994","repo":"BerriAI/litellm","slug":"saml-assertion-did-not-contain-a-usable-subject-n","errorCode":null,"errorMessage":"SAML assertion did not contain a usable subject (NameID) or email.","messagePattern":"SAML assertion did not contain a usable subject \\(NameID\\) or email\\.","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/sso/saml_sso.py","lineNumber":434,"sourceCode":"        attributes: Final = cast(dict[str, list[str]], auth.get_attributes())  # cast-ok: untyped python3-saml\n        name_id: Final = cast(str | None, auth.get_nameid())  # cast-ok: untyped python3-saml\n\n        email = SAMLAuthHandler._attribute_value(attributes, \"SAML_ATTRIBUTE_EMAIL\", _EMAIL_ATTRIBUTE_CANDIDATES)\n        if email is None and name_id is not None and \"@\" in name_id:\n            email = name_id\n\n        if email is None and SAMLAuthHandler._env(\"ALLOWED_EMAIL_DOMAINS\") is not None:\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=(\n                    \"SAML assertion did not contain an email address, but ALLOWED_EMAIL_DOMAINS \"\n                    \"restricts sign-in by email domain.\"\n                ),\n            )\n\n        user_id: Final = SAMLAuthHandler._attribute_value(attributes, \"SAML_ATTRIBUTE_USER_ID\", ()) or name_id or email\n        if user_id is None:\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=\"SAML assertion did not contain a usable subject (NameID) or email.\",\n            )\n\n        first_name: Final = SAMLAuthHandler._attribute_value(\n            attributes, \"SAML_ATTRIBUTE_FIRST_NAME\", _FIRST_NAME_ATTRIBUTE_CANDIDATES\n        )\n        last_name: Final = SAMLAuthHandler._attribute_value(\n            attributes, \"SAML_ATTRIBUTE_LAST_NAME\", _LAST_NAME_ATTRIBUTE_CANDIDATES\n        )\n        role_value = SAMLAuthHandler._attribute_value(attributes, \"SAML_ATTRIBUTE_ROLE\", _ROLE_ATTRIBUTE_CANDIDATES)\n        team_ids: Final = SAMLAuthHandler._attribute_values(\n            attributes, \"SAML_ATTRIBUTE_TEAM_IDS\", _TEAM_IDS_ATTRIBUTE_CANDIDATES\n        )\n\n        display_name: Final = \" \".join(part for part in (first_name, last_name) if part) or email\n\n        verbose_proxy_logger.info(","sourceCodeStart":416,"sourceCodeEnd":452,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/sso/saml_sso.py#L416-L452","documentation":"Neither the configured email attribute candidates nor a NameID containing '@' yielded an email, and no role/subject info could produce a usable identity: the assertion lacks a usable subject, so the login cannot proceed and a 401 is raised.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:434 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the IdP to send a NameID or email attribute in the assertion."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}