From 9098c7dcfcd4d16dde20ef66e761998b3ff092c9 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 19 Jul 2026 02:19:19 +1000 Subject: [PATCH] Add LiteLLM OAuth2/OIDC provider SSO for LiteLLM (litellm.k8s.syd1.au.unkin.net) via Authentik generic OIDC. Confidential OAuth2 provider + application, openid/email/profile scopes, /sso/callback redirect. client_secret read from Vault at kv/kubernetes/namespace/litellm/default/oauth-credentials (seeded). --- config/providers_oauth2/litellm.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 config/providers_oauth2/litellm.yaml diff --git a/config/providers_oauth2/litellm.yaml b/config/providers_oauth2/litellm.yaml new file mode 100644 index 0000000..061dd04 --- /dev/null +++ b/config/providers_oauth2/litellm.yaml @@ -0,0 +1,18 @@ +# OAuth2/OIDC provider + application for LiteLLM +# (litellm.k8s.syd1.au.unkin.net). client_secret is read from Vault, not committed. +# LiteLLM's generic SSO redirects back to /sso/callback. +name: LiteLLM +authorization_flow: default-provider-authorization-implicit-consent +invalidation_flow: default-provider-invalidation-flow +client_type: confidential +client_id: litellm +client_secret_vault: + mount: kv + path: kubernetes/namespace/litellm/default/oauth-credentials +scope_mappings: + - goauthentik.io/providers/oauth2/scope-openid + - goauthentik.io/providers/oauth2/scope-email + - goauthentik.io/providers/oauth2/scope-profile +redirect_uris: + - matching_mode: strict + url: https://litellm.k8s.syd1.au.unkin.net/sso/callback