unkinben
a93205bc82
Ben (akR-global-admin) does not see the LiteLLM tile on the Authentik user dashboard, while ArgoCD/Grafana/Rancher appear normally. The live API shows LiteLLM is configured identically to those apps: the app exists, its access binding akP-litellm-admin -> litellm is present, and akR-global-admin nests akP-litellm-admin (bidirectionally, same as the others). A CI-style plan against live state reports "No changes" -- so this is not terraform-correctable drift, and a plain re-apply fixes nothing. Yet check_access for Ben returns passing=false for litellm and passing=true for the rest: a stale cached access policy result inside Authentik. Add an optional per-app launch_url to the providers_oauth2 config (default null, which keeps Authentik's redirect-derived URL) and wire it to the application's meta_launch_url. Set it for LiteLLM to its UI. This makes the dashboard tile deterministic and, on apply, re-saves the application -- invalidating the stale access-policy cache so Ben's (already-correct) access re-evaluates and the tile appears. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
34 lines
1.4 KiB
YAML
34 lines
1.4 KiB
YAML
# OAuth2/OIDC provider + application for LiteLLM
|
|
# (litellm.k8s.syd1.au.unkin.net). client_secret is read from Vault, not committed.
|
|
# LiteLLM's generic SSO redirects back to /sso/callback.
|
|
name: LiteLLM
|
|
authorization_flow: default-provider-authorization-implicit-consent
|
|
invalidation_flow: default-provider-invalidation-flow
|
|
client_type: confidential
|
|
client_id: litellm
|
|
# Explicit dashboard tile launch URL (the LiteLLM UI). Authentik would otherwise
|
|
# derive this from the redirect_uri; setting it here makes the tile deterministic
|
|
# and forces an application re-save so the cached access policy is re-evaluated.
|
|
launch_url: https://litellm.k8s.syd1.au.unkin.net/
|
|
client_secret_vault:
|
|
mount: kv
|
|
path: kubernetes/namespace/litellm/default/oauth-credentials
|
|
scope_mappings:
|
|
- goauthentik.io/providers/oauth2/scope-openid
|
|
- goauthentik.io/providers/oauth2/scope-email
|
|
- goauthentik.io/providers/oauth2/scope-profile
|
|
redirect_uris:
|
|
- matching_mode: strict
|
|
url: https://litellm.k8s.syd1.au.unkin.net/sso/callback
|
|
# Emit a `litellm_role` claim from group membership (rules in privilege order).
|
|
# LiteLLM requests the `litellm_role` scope and reads it via
|
|
# GENERIC_USER_ROLE_ATTRIBUTE. akP-litellm-admin is inherited by akR-global-admin.
|
|
role_mappings:
|
|
claim: litellm_role
|
|
default: internal_user_view_only
|
|
rules:
|
|
- group: akP-litellm-admin
|
|
role: proxy_admin
|
|
- group: akP-litellm-user
|
|
role: internal_user
|