SAML login failed: missing AuthnRequest ID in >v5.0.0

[samueljsb]

We are using social-auth-app-django to authenticate with Okta and have had no problems with the integration up to v5 of social-auth-core. We are now getting inconsistent errors when the SAML response is returned to our application:

Traceback (most recent call last):
  File ".../lib/python3.14/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
  File ".../lib/python3.14/site-packages/django/core/handlers/base.py", line 198, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File ".../lib/python3.14/site-packages/django/views/decorators/cache.py", line 80, in _view_wrapper
    response = view_func(request, *args, **kwargs)
  File ".../lib/python3.14/site-packages/django/views/decorators/csrf.py", line 65, in _view_wrapper
    return view_func(request, *args, **kwargs)
  File ".../lib/python3.14/site-packages/social_django/utils.py", line 42, in wrapper
    return func(request, backend, *args, **kwargs)
  File ".../lib/python3.14/site-packages/social_django/views.py", line 33, in complete
    return do_complete(
        request.backend,
    ...<5 lines>...
        **kwargs,
    )
  File ".../lib/python3.14/site-packages/social_core/actions.py", line 135, in do_complete
    authenticated_user = backend.complete(
        *args, user=authenticated_user, redirect_name=redirect_name, **kwargs
    )
  File ".../lib/python3.14/site-packages/social_core/backends/base.py", line 61, in complete
    return self.auth_complete(*args, **kwargs)
           ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File ".../lib/python3.14/site-packages/social_core/backends/saml.py", line 570, in auth_complete
    session_restored, request_id_validated = self._validate_auth_response(
                                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        auth,
        ^^^^^
    ...<4 lines>...
        response_in_response_to,
        ^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File ".../lib/python3.14/site-packages/social_core/backends/saml.py", line 382, in _validate_auth_response
    raise AuthFailed(self, "SAML login failed: missing AuthnRequest ID")
social_core.exceptions.AuthFailed: Authentication failed: SAML login failed: missing AuthnRequest ID
Internal Server Error: /auth/complete/saml/
Traceback (most recent call last):
  File ".../lib/python3.14/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
  File ".../lib/python3.14/site-packages/django/core/handlers/base.py", line 198, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File ".../lib/python3.14/site-packages/django/views/decorators/cache.py", line 80, in _view_wrapper
    response = view_func(request, *args, **kwargs)
  File ".../lib/python3.14/site-packages/django/views/decorators/csrf.py", line 65, in _view_wrapper
    return view_func(request, *args, **kwargs)
  File ".../lib/python3.14/site-packages/social_django/utils.py", line 42, in wrapper
    return func(request, backend, *args, **kwargs)
  File ".../lib/python3.14/site-packages/social_django/views.py", line 33, in complete
    return do_complete(
        request.backend,
    ...<5 lines>...
        **kwargs,
    )
  File ".../lib/python3.14/site-packages/social_core/actions.py", line 135, in do_complete
    authenticated_user = backend.complete(
        *args, user=authenticated_user, redirect_name=redirect_name, **kwargs
    )
  File ".../lib/python3.14/site-packages/social_core/backends/base.py", line 61, in complete
    return self.auth_complete(*args, **kwargs)
           ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File ".../lib/python3.14/site-packages/social_core/backends/saml.py", line 570, in auth_complete
    session_restored, request_id_validated = self._validate_auth_response(
                                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        auth,
        ^^^^^
    ...<4 lines>...
        response_in_response_to,
        ^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File ".../lib/python3.14/site-packages/social_core/backends/saml.py", line 382, in _validate_auth_response
    raise AuthFailed(self, "SAML login failed: missing AuthnRequest ID")
social_core.exceptions.AuthFailed: Authentication failed: SAML login failed: missing AuthnRequest ID
"POST /auth/complete/saml/?idp=okta HTTP/1.1" 500 130652

This happens approximately half the time we authenticate while running the application locally against a live Okta deployment. We've tried to investigate what's causing this and have discovered #1794 as the PR that introduced the check that's now (sometimes) failing, but we can't find any cause for the inconsistency, nor do we understand what the error is trying to tell us is wrong.

We're happy to provide more information if it would be helpful, but we're not sure where to go from here.

Versions:

• Python: 3.14.6
• Django: 6.0.6
• social-auth-app-django: 6.0.0
• social-auth-core: 5.0.2

[nijel]

Can you check whether these are IdP-initiated flows or SP-initiated ones?

[samueljsb]

Could you clarify what you mean by that, and how I might check, please?

[nijel]

IdP-initiated flows are triggered by IdP and will not show previous /auth/login/saml/ from the same address in the server logs.

[samueljsb]

Ahh these are SP-initiated, then.