unkinben
9098c7dcfc
SSO for LiteLLM (litellm.k8s.syd1.au.unkin.net) via Authentik generic OIDC. Confidential OAuth2 provider + application, openid/email/profile scopes, /sso/callback redirect. client_secret read from Vault at kv/kubernetes/namespace/litellm/default/oauth-credentials (seeded).
19 lines
731 B
YAML
19 lines
731 B
YAML
# OAuth2/OIDC provider + application for LiteLLM
|
|
# (litellm.k8s.syd1.au.unkin.net). client_secret is read from Vault, not committed.
|
|
# LiteLLM's generic SSO redirects back to /sso/callback.
|
|
name: LiteLLM
|
|
authorization_flow: default-provider-authorization-implicit-consent
|
|
invalidation_flow: default-provider-invalidation-flow
|
|
client_type: confidential
|
|
client_id: litellm
|
|
client_secret_vault:
|
|
mount: kv
|
|
path: kubernetes/namespace/litellm/default/oauth-credentials
|
|
scope_mappings:
|
|
- goauthentik.io/providers/oauth2/scope-openid
|
|
- goauthentik.io/providers/oauth2/scope-email
|
|
- goauthentik.io/providers/oauth2/scope-profile
|
|
redirect_uris:
|
|
- matching_mode: strict
|
|
url: https://litellm.k8s.syd1.au.unkin.net/sso/callback
|