{"record":{"id":"ae7ce3b265a629eb","repo":"BerriAI/litellm","slug":"saml-authentication-failed-reason-or-join-e","errorCode":null,"errorMessage":"SAML authentication failed: {reason or ', '.join(errors)}","messagePattern":"SAML authentication failed: (.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/sso/saml_sso.py","lineNumber":322,"sourceCode":"\n        return dict(parse_qsl(body.decode(\"utf-8\", \"replace\")))\n\n    @staticmethod\n    async def handle_acs(request: Request, cache: DualCache, post_data: dict[str, str]) -> CustomOpenID:\n        auth: Final = await SAMLAuthHandler._build_auth(request, cache, post_data=post_data)\n        browser_request_id: Final = request.cookies.get(_SAML_AUTHN_STATE_COOKIE)\n        try:\n            auth.process_response(request_id=browser_request_id)\n        except Exception as e:  # noqa: BLE001 - toolkit exposes no common exception base; fail closed\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=f\"Could not process SAML response: {e}\",\n            )\n\n        errors: Final = cast(list[str], auth.get_errors())  # cast-ok: untyped python3-saml\n        if errors or not auth.is_authenticated():\n            reason: Final = auth.get_last_error_reason()\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=f\"SAML authentication failed: {reason or ', '.join(errors)}\",\n            )\n\n        await SAMLAuthHandler._enforce_response_binding(auth, cache, browser_request_id)\n        return SAMLAuthHandler._result_from_auth(auth)\n\n    @staticmethod\n    def _replay_guard_ttl(auth: \"OneLogin_Saml2_Auth\") -> int:\n        not_on_or_after: Final = auth.get_last_assertion_not_on_or_after()\n        if not isinstance(not_on_or_after, int):\n            return _SAML_REPLAY_GUARD_DEFAULT_TTL_SECONDS\n        remaining: Final = not_on_or_after - int(time.time())\n        return min(\n            max(remaining, _SAML_REPLAY_GUARD_DEFAULT_TTL_SECONDS),\n            _SAML_REPLAY_GUARD_MAX_TTL_SECONDS,\n        )\n","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/sso/saml_sso.py#L304-L340","documentation":"Post-processing check: the toolkit reports the response was not successfully processed — errors are non-empty, or a reason string was provided for an unauthenticated user. Raised as 401; at-fault cause is signature/timestamp/audience validation failure at the IdP response.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:322 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Review the failure reason in the message; verify certificates, timestamps, and audience restrictions."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}