{"record":{"id":"ffffe96401224984","repo":"BerriAI/litellm","slug":"saml-assertion-contained-an-invalid-subject-or-ema","errorCode":null,"errorMessage":"SAML assertion contained an invalid subject or email: {e}","messagePattern":"SAML assertion contained an invalid subject or email: (.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/sso/saml_sso.py","lineNumber":469,"sourceCode":"\n        verbose_proxy_logger.info(\n            \"SAML login: subject=%s, email=%s, attributes=%s\", user_id, email, list(attributes.keys())\n        )\n\n        try:\n            return CustomOpenID(\n                id=user_id,\n                email=email,\n                first_name=first_name,\n                last_name=last_name,\n                display_name=display_name,\n                picture=None,\n                provider=\"saml\",\n                team_ids=team_ids,\n                user_role=get_litellm_user_role(role_value) if role_value else None,\n            )\n        except ValidationError as e:\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=f\"SAML assertion contained an invalid subject or email: {e}\",\n            )\n\n    @staticmethod\n    def _attribute_value(\n        attributes: dict[str, list[str]],\n        env_override: str,\n        candidates: tuple[str, ...],\n    ) -> str | None:\n        values: Final = SAMLAuthHandler._attribute_values(attributes, env_override, candidates)\n        return values[0] if values else None\n\n    @staticmethod\n    def _attribute_values(\n        attributes: dict[str, list[str]],\n        env_override: str,\n        candidates: tuple[str, ...],","sourceCodeStart":451,"sourceCodeEnd":487,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/sso/saml_sso.py#L451-L487","documentation":"Constructing the final CustomOpenID from the validated SAML subject/email triggered a pydantic ValidationError (e.g. malformed email or identity fields failing model constraints). The exception is converted into an HTTPException so the browser gets a clear 4xx instead of a stack trace.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:469 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the subject/email attribute format in the IdP assertion."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}