From 91080c150497ce306f8e21a03eb06f572475179c Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 19 Jul 2026 18:43:13 +1000 Subject: [PATCH] LiteLLM SSO: request litellm_role scope + map to role Pairs with terraform-authentik#10: request the litellm_role scope (Authentik emits the computed role claim) and read it via GENERIC_USER_ROLE_ATTRIBUTE so akP-litellm-admin -> proxy_admin, akP-litellm-user -> internal_user. --- apps/base/litellm/kustomization.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/apps/base/litellm/kustomization.yaml b/apps/base/litellm/kustomization.yaml index b4780fe..61754ea 100644 --- a/apps/base/litellm/kustomization.yaml +++ b/apps/base/litellm/kustomization.yaml @@ -32,7 +32,10 @@ configMapGenerator: - GENERIC_AUTHORIZATION_ENDPOINT=https://identity.unkin.net/application/o/authorize/ - GENERIC_TOKEN_ENDPOINT=https://identity.unkin.net/application/o/token/ - GENERIC_USERINFO_ENDPOINT=https://identity.unkin.net/application/o/userinfo/ - - GENERIC_SCOPE=openid email profile + # litellm_role scope carries the Authentik-computed role claim; LiteLLM + # reads it via GENERIC_USER_ROLE_ATTRIBUTE and maps to proxy_admin/etc. + - GENERIC_SCOPE=openid email profile litellm_role + - GENERIC_USER_ROLE_ATTRIBUTE=litellm_role - PROXY_BASE_URL=https://litellm.k8s.syd1.au.unkin.net options: disableNameSuffixHash: true