Add LiteLLM RBAC: akP-litellm groups + role claim mapping #10

2026-07-19T18:42:49+10:00

unkinben commented

2026-07-19 18:42:49 +10:00

Why

Bring LiteLLM into the two-tier Authentik RBAC and map groups to LiteLLM roles (admin vs user), so akR-global-admin members become LiteLLM proxy admins automatically.

Change

akP-litellm-admin / akP-litellm-user permission groups (bound to the litellm app for access); added to akR-global-admin / akR-standard-user.
Generic role_mappings on oauth2 providers (reusable): emits an app role claim computed from effective (hierarchical) group membership — first matching rule wins, else default.
LiteLLM: emits litellm_role = proxy_admin (akP-litellm-admin) / internal_user (akP-litellm-user) / internal_user_view_only (default). LiteLLM reads it via GENERIC_USER_ROLE_ATTRIBUTE (paired argocd-apps change).

Validation

terragrunt plan: 5 to add (2 perm groups, 2 access bindings, 1 role mapping), 3 to change (roles gain akP-litellm-*; litellm provider gets the role mapping). Generated role expression renders correctly.

Pairs with

argocd-apps#268 (adds litellm_role to GENERIC_SCOPE + GENERIC_USER_ROLE_ATTRIBUTE=litellm_role).

## Why Bring LiteLLM into the two-tier Authentik RBAC and map groups to LiteLLM roles (admin vs user), so `akR-global-admin` members become LiteLLM proxy admins automatically. ## Change - **akP-litellm-admin / akP-litellm-user** permission groups (bound to the litellm app for access); added to `akR-global-admin` / `akR-standard-user`. - **Generic `role_mappings`** on oauth2 providers (reusable): emits an app role claim computed from *effective* (hierarchical) group membership — first matching rule wins, else default. - **LiteLLM**: emits `litellm_role` = `proxy_admin` (akP-litellm-admin) / `internal_user` (akP-litellm-user) / `internal_user_view_only` (default). LiteLLM reads it via `GENERIC_USER_ROLE_ATTRIBUTE` (paired argocd-apps change). ## Validation `terragrunt plan`: 5 to add (2 perm groups, 2 access bindings, 1 role mapping), 3 to change (roles gain akP-litellm-*; litellm provider gets the role mapping). Generated role expression renders correctly. ## Pairs with argocd-apps#268 (adds `litellm_role` to GENERIC_SCOPE + `GENERIC_USER_ROLE_ATTRIBUTE=litellm_role`).

unkinben added 1 commit 2026-07-19 18:42:49 +10:00

Add LiteLLM RBAC: akP-litellm groups + role claim mapping

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

7610627168

Bring LiteLLM into the two-tier RBAC and map groups to LiteLLM roles.

- akP-litellm-admin / akP-litellm-user permission groups (bound to the litellm
  app for access); added to akR-global-admin / akR-standard-user roles.
- Generic per-provider role_mappings: emit an app role claim computed from
  effective (hierarchical) group membership. LiteLLM: emits `litellm_role`
  (proxy_admin for akP-litellm-admin, internal_user for akP-litellm-user, else
  internal_user_view_only); LiteLLM reads it via GENERIC_USER_ROLE_ATTRIBUTE.

Validated: plan 5 to add, 3 to change; generated role expression renders correctly.

benvin merged commit 70c1d4f6ba into main

2026-07-19 22:00:59 +10:00

benvin deleted branch benvin/litellm-rbac

2026-07-19 22:00:59 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#10