unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Wire LiteLLM SSO to Authentik (generic OIDC) #268

Merged
unkinben merged 2 commits from benvin/litellm-sso into main 2026-07-24 00:18:42 +10:00
Conversation 1 Commits 2 Files Changed 3
+38

2 Commits

Author SHA1 Message Date
unkinben 91080c1504 LiteLLM SSO: request litellm_role scope + map to role
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details 
Pairs with terraform-authentik#10: request the litellm_role scope (Authentik
emits the computed role claim) and read it via GENERIC_USER_ROLE_ATTRIBUTE so
akP-litellm-admin -> proxy_admin, akP-litellm-user -> internal_user.
 2026-07-19 18:43:13 +10:00
unkinben 5380a9fbf4 Wire LiteLLM SSO to Authentik (generic OIDC)
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details 
App-side of the LiteLLM Authentik onboarding (terraform-authentik#8). Configures
LiteLLM's generic OIDC SSO against Authentik.

- VaultStaticSecret oauth-credentials: surfaces the OIDC client secret (same
  secret Authentik sets on the provider) as a k8s Secret.
- Deployment: GENERIC_CLIENT_SECRET from that Secret.
- litellm-env: GENERIC_CLIENT_ID, authorization/token/userinfo endpoints, scope,
  and PROXY_BASE_URL (required for SSO). reloader restarts on secret/config change.
 2026-07-19 18:27:31 +10:00