{"record":{"id":"ada87b525f02c10a","repo":"BerriAI/litellm","slug":"invalid-sp-metadata-join-errors","errorCode":null,"errorMessage":"Invalid SP metadata: {', '.join(errors)}","messagePattern":"Invalid SP metadata: (.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":500,"severity":"error","filePath":"litellm/proxy/management_endpoints/sso/saml_sso.py","lineNumber":277,"sourceCode":"                value=request_id,\n                max_age=_SAML_AUTHN_REQUEST_TTL_SECONDS,\n                httponly=True,\n                secure=secure,\n                samesite=\"none\" if secure else \"lax\",\n            )\n        return response\n\n    @staticmethod\n    async def build_sp_metadata(request: Request, cache: DualCache) -> str:\n        if not SAML_AVAILABLE:\n            raise _saml_unavailable_error()\n        idp_settings: Final = await SAMLAuthHandler._load_idp_settings(cache)\n        settings: Final = SAMLAuthHandler._build_settings(request, idp_settings)\n        saml_settings: Final = OneLogin_Saml2_Settings(settings, sp_validation_only=True)\n        metadata: Final = cast(str, saml_settings.get_sp_metadata())  # cast-ok: untyped python3-saml\n        errors: Final = cast(list[str], saml_settings.validate_metadata(metadata))  # cast-ok: untyped python3-saml\n        if errors:\n            raise HTTPException(\n                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,\n                detail=f\"Invalid SP metadata: {', '.join(errors)}\",\n            )\n        return metadata\n\n    @staticmethod\n    async def read_acs_post_data(request: Request) -> dict[str, str]:\n        \"\"\"Read the ACS POST form under a hard size cap before any base64/XML decoding.\n\n        Bounds both Content-Length-declared and chunked requests so an unauthenticated\n        caller cannot force unbounded buffering while decoding the SAMLResponse.\"\"\"\n        declared: Final = request.headers.get(\"content-length\")\n        if declared is not None and declared.isdigit() and int(declared) > _SAML_MAX_POST_BYTES:\n            raise HTTPException(\n                status_code=status.HTTP_413_CONTENT_TOO_LARGE,\n                detail=\"SAML response exceeds the maximum allowed size.\",\n            )\n","sourceCodeStart":259,"sourceCodeEnd":295,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/sso/saml_sso.py#L259-L295","documentation":"build_sp_metadata validates the generated SP metadata document with python3-saml; the toolkit reports validation errors, which are joined into this 500 detail. It means the proxy's own SP metadata could not be produced cleanly — typically a bad SP key/cert or entity id configuration.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:277 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the SP metadata fields listed in the error."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}