unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

LiteLLM SSO: request litellm_role scope + map to role
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details

Browse Source 
Pairs with terraform-authentik#10: request the litellm_role scope (Authentik
emits the computed role claim) and read it via GENERIC_USER_ROLE_ATTRIBUTE so
akP-litellm-admin -> proxy_admin, akP-litellm-user -> internal_user.
This commit is contained in:
Ben Vincent
2026-07-19 18:43:13 +10:00
parent 5380a9fbf4
commit 91080c1504
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/litellm/kustomization.yaml
+4 -1
View File
@@ -32,7 +32,10 @@ configMapGenerator:
- GENERIC_AUTHORIZATION_ENDPOINT=https://identity.unkin.net/application/o/authorize/
- GENERIC_TOKEN_ENDPOINT=https://identity.unkin.net/application/o/token/
- GENERIC_USERINFO_ENDPOINT=https://identity.unkin.net/application/o/userinfo/
- GENERIC_SCOPE=openid email profile
# litellm_role scope carries the Authentik-computed role claim; LiteLLM
# reads it via GENERIC_USER_ROLE_ATTRIBUTE and maps to proxy_admin/etc.
- GENERIC_SCOPE=openid email profile litellm_role
- GENERIC_USER_ROLE_ATTRIBUTE=litellm_role
- PROXY_BASE_URL=https://litellm.k8s.syd1.au.unkin.net
options:
disableNameSuffixHash: true