wpscanteam/wpscan · error · WPScan::Error::SAMLAuthenticationRequired

SAML authentication is required to access this resource, con

Error message

SAML authentication is required to access this resource, consider using --expect-saml.

What it means

Raised by Core#handle_saml_authentication (app/controllers/core.rb:113) when a SAMLRequest is detected in the response or its redirect chain (Core#saml_request?) but --expect-saml was not given. It signals that the target sits behind a SAML identity provider and WPScan will not attempt the interactive headless-browser login unless you opt in with --expect-saml.

Source

Thrown at app/controllers/core.rb:113

        return true if effective_uri.to_s.match?(/[?&]SAMLRequest/i)

        # SAML flows often bounce through intermediate pages before the IdP;
        # walk the redirect chain to catch a SAMLRequest in any Location header.
        !!homepage_res&.redirections&.any? do |redirect_response|
          redirect_response.headers['Location']&.match?(/SAMLRequest/i)
        end
      end

      # Drives an interactive SAML login via a headless browser, injects the
      # resulting session cookies into the shared Browser, and clears the target's
      # cached homepage so the rest of the scan runs against the authenticated session.
      #
      # @param [ Addressable::URI ] effective_uri  URL that triggered the SAML redirect
      #
      # @return [ Void ]
      def handle_saml_authentication(effective_uri)
        raise Error::SAMLAuthenticationFailed if WPScan::ParsedCli.cookie_string && !WPScan::ParsedCli.expect_saml
        raise Error::SAMLAuthenticationRequired unless WPScan::ParsedCli.expect_saml

        new_cookies = BrowserAuthenticator.authenticate(effective_uri.to_s)

        browser = WPScan::Browser.instance
        browser.cookie_string = [browser.cookie_string, new_cookies].compact.reject(&:empty?).join('; ')

        # Discard the pre-auth homepage so subsequent finders refetch with the new cookies.
        target.reset_homepage_cache!

        @saml_authenticated = true
      end

      # Checks for redirects; an out-of-scope redirect raises Error::HTTPRedirect.
      #
      # @param [ Typhoeus::Response ] res
      def handle_redirection(res)
        effective_url = target.homepage_res.effective_url # get and follow location of target.url
        effective_uri = Addressable::URI.parse(effective_url)

View on GitHub (pinned to 62c9cef471)

Solutions

Re-run with --expect-saml: WPScan opens a browser window, you complete the login, press enter, and the resulting cookies are injected into the scan
Ensure the run can support interactive auth: Chrome/Chromium on PATH and a real TTY (BrowserAuthenticator raises otherwise)
Alternative: log in manually in a browser and pass the session with --cookie-string instead of --expect-saml

Example fix

# before
wpscan --url https://sso-protected.example.com
# => SAML authentication is required ... consider using --expect-saml.

# after
wpscan --url https://sso-protected.example.com --expect-saml

Defensive patterns

Strategy: validation

Validate before calling

# Detect the SAML redirect chain before launching the scan
res = Typhoeus.get(url, followlocation: true)
has_saml = res.effective_url.match?(/[?&]SAMLRequest/i) ||
           res.redirections.any? { |r| r.headers['Location'].to_s.match?(/SAMLRequest/i) }
ARGV.push('--expect-saml') if has_saml

Try / catch

begin
  scan.run
rescue WPScan::Error::SAMLAuthenticationRequired
  retry with '--expect-saml' appended (requires a TTY and Chrome/Chromium)
end

Prevention

Always pass --expect-saml up front for SSO-protected targets
Keep Chrome/Chromium on PATH for the Ferrum-driven login
Run wpscan from a real shell (TTY) when interactive auth may be needed
--expect-saml on a non-SAML site is harmless: it prints 'expected but not required'

When it happens

Trigger: Plain `wpscan --url https://target` (no --expect-saml, no --cookie-string) where the homepage 302s to an IdP URL containing a SAMLRequest parameter, or any intermediate Location header in homepage_res.redirections matches /SAMLRequest/i.

Common situations: Corporate/intranet WordPress behind ADFS, Okta, Azure AD/Entra or Keycloak SSO; staging sites recently put behind SSO; scanning from a machine whose SSO session has expired.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of wpscanteam/wpscan@62c9cef471 (2026-08-21). Data as JSON: /api/errors/8a41b86f96761ff1. Report an issue: GitHub.