SSO Login error - SAML - ‘CHALLENGE_RESPONSE_ACTION_ERROR’,{“error”:‘EINVAL’}] - Edit Cryptpad code to fix it?

[racingfoss]

Description

With the SSO login configuration via SAML complete, after the user enters their credentials in the IDP, the SSO login does not complete. Cryptpad returns the following error:

(I am replacing as my environment is not public)

V 2025.9.0

1. Nginx log: ‘POST /api/auth/ HTTP/2.0’ 200 77 ‘https:///ssoauth/’
2. Cryptpad log: ‘CHALLENGE_RESPONSE_ACTION_ERROR’,{“error”:‘NO_COOKIE’}]
3. Nginx log: ‘POST /api/auth/ HTTP/2.0’ 500 51 ‘https:///ssoauth/’

V 2026.2.0
[‘ERROR’,‘2026-03-02T17:50:07.474Z’,‘CHALLENGE_RESPONSE_ACTION_ERROR’,{“error”:‘EINVAL’}]
Failed to delete SSO request 1ldsvjc8cot

I have configured the subdomains, and I have installed version 0.0.4 of the SSO plugin. I tried both Cryptpad 2025.9.0 and 2026.2.0.
The cryptpad diagnosis (checkup) does not return any warnings or errors.

The SSO plugin configuration is as follows:
const fs = require(“node:fs”);
module.exports = {
// Enable SSO login on this instance
enabled: true,
// Block registration for non-SSO users on this instance
enforced: false,
// Allow users to add an additional CryptPad password to their SSO account
cpPassword: false,
// You can also force your SSO users to add a CryptPad password
forceCpPassword: false,
// List of SSO providers
list: [
{
name: “test”,
type: “saml”,
url: “https:///module.php/saml/idp/singleSignOnService”,
issuer: “”,
cert: fs.readFileSync(‘/cryptpad/config/sso-certs/idp-cert.pem’, ‘utf-8’),
username_attr: “mail”
}
]
};

In username_attr, I tried sAMAccountName, mail, and leaving it empty.
The idp sends both values.

I was able to get the SAML SSO login working.
To fix this, line 261 of file lib/http-worker.js was modified:
From: let value = samltoken=‘${token}’; SameSite=Strict; HttpOnly;
To: let value = samltoken=‘${token}’; Path=/; SameSite=Strict; HttpOnly;

Do you have an environment to test the SAML login? Could you please check if the same thing happens to you?

(On the other hand, although I am no longer sure if it is an IDP issue, with that fix users can now log in, but each time they log in again, a new user is created, despite the fact that I am always logging in with the same user at the IDP level.)

Steps to reproduce

1. Click on the SAML button.
2. Enter user credentials in the interface provided by the IDP.
3. Cryptpad keeps loading and never logs in (that is when it records the log).

Relevant logs

[‘ERROR’,‘2026-03-02T17:50:07.474Z’,‘CHALLENGE_RESPONSE_ACTION_ERROR’,{“error”:‘EINVAL’}]
Failed to delete SSO request 1ldsvjc8cot

Expected behavior

correct sso saml login

Which operating system are you using?

No response

What browsers are you seeing the problem on?

No response

Extensions

None

Version

2026.2.0

[davidbenque]

Hello and thank you for this report. This issue should be fixed in the CryptPad Spring Release and SSO plugin 0.5.0 or latest. However we were not able to reproduce this part "each time they log in again, a new user is created". Please confirm this still happens after an upgrading.

[racingfoss]

Hello David,

Thats really great news, thank you. I will update and test this week or the next one, and then I confirm you.

[racingfoss]

Oh, I almost forgot something: the part of "each time they log in again, a new user is created" was resolved at the IDP level.