{"record":{"id":"cdfb588a0b694cc0","repo":"BerriAI/litellm","slug":"unsolicited-idp-initiated-saml-responses-are-dis","errorCode":null,"errorMessage":"Unsolicited (IdP-initiated) SAML responses are disabled.","messagePattern":"Unsolicited \\(IdP-initiated\\) SAML responses are disabled\\.","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/sso/saml_sso.py","lineNumber":385,"sourceCode":"        if in_response_to is not None:\n            authn_key: Final = f\"{_SAML_AUTHN_REQUEST_CACHE_PREFIX}:{in_response_to}\"\n            if cache.get_cache(key=authn_key) is None:\n                raise HTTPException(\n                    status_code=status.HTTP_401_UNAUTHORIZED,\n                    detail=\"SAML response references an unknown or already-used login request.\",\n                )\n            if browser_request_id is None or not secrets.compare_digest(browser_request_id, in_response_to):\n                raise HTTPException(\n                    status_code=status.HTTP_401_UNAUTHORIZED,\n                    detail=\"SAML response is not bound to this browser's login request.\",\n                )\n        elif browser_request_id is not None:\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=\"SAML response is not bound to this browser's login request.\",\n            )\n        elif not SAMLAuthHandler._bool_env(\"SAML_ALLOW_UNSOLICITED\", False):\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=\"Unsolicited (IdP-initiated) SAML responses are disabled.\",\n            )\n        elif cache.redis_cache is None:\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=(\n                    \"Unsolicited (IdP-initiated) SAML responses require a shared Redis cache \"\n                    \"so the replay guard is enforced across every worker.\"\n                ),\n            )\n\n        assertion_id: Final = cast(str | None, auth.get_last_assertion_id())  # cast-ok: untyped python3-saml\n        if assertion_id is None:\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=\"SAML assertion is missing the required ID attribute.\",\n            )","sourceCodeStart":367,"sourceCodeEnd":403,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/sso/saml_sso.py#L367-L403","documentation":"An IdP-initiated (unsolicited) response arrived — no InResponseTo — while SAML_ALLOW_UNSOLICITED is not enabled, so the login is refused with 401. At-fault condition is the deployment's unsolicited-response policy versus the IdP's behavior.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:385 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Initiate login from the SP (proxy login page) instead of the IdP, or enable IdP-initiated SSO explicitly."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}