tPjXTUdZddlZddlZddlZddlZddlZddlZddlZddlZddl m Z m Z ddl m Z ddlmZddlmZddlmZmZmZmZmZmZmZmZmZmZmZddlmZm Z m!Z!erddl"Z"ddl#Z#dd l$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+dd l,m-Z-dd l.m/Z/m0Z0m1Z1m2Z2m3Z3ddl4Z4dd l5m6Z6dd l7m8Z8ddl9m:Z:ddl;mZ>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZFmGZGddlHmIZIddlJmKZKmLZLmMZMddlNmOZOmPZPmQZQddlRmSZSmTZTmUZUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^ddl_m`Z`maZaddlbmcZcmdZdddlemfZfddlgmhZhddlimjZjmkZkddllmmZmddlnmoZoddlpmqZqddlrmsZsddltmuZuddlvmwZwddlxmyZymzZzdd l{m|Z|m}Z}dd!l~mZmZmZdd"lmZmZmZmZdd#lmZdd$lmZdd%lmZdd&lmZdd'lmZmZmZdd(ldd)lmZmZmZmZmZmZdd*lmZerdd+lmZndd,lmZe%Zeed-<ehd.Zeed/<e>d0Zeed1<ed2Zeed3<d4Zeed5<d6Zeed7<d8Zeed9<ejNd:Zeed;<ejNdZeeeefZeed?<ejNd@ZeedA<ehdBZeedC<GdDdEeZdFedGdHfdIZGdJdKeZdFedGdLfdMZGdNdOeZdFedGdPfdQZe2eeefZeedR<e2e eefZeedS<dTedGefdUZGdVdWe/ZGdXdYe/ZGdZd[e/Ze2eed\fZeed]<ed^_Zeed`<GdadbeZGdcddeZGdedfeZdTedGefdgZdhedGefdiZdjedGefdkZdGefdlZdmedGefdnZdmedzdGefdoZdjedzdGefdpZdGefdqZdmedredjedsedzdGeeeezff dtZ͐ddve)dwedzdGefdxZ ddve)dye:dwedzdGdfdzZdmedzdye:dGefd{Zdmedye:d|edGdfd}Zd|edredzdGefd~ZdGeeeeffdZdedGefdZdTedGefdZdeezeeefzdGeeeffdZde eefdedGefdZdeezeeefzdedGefdZdeeefdedTedGdfdZde eefdGeeeezezezffdZdeezeeefzdGeeeffdZdeeefdeeefdGeeeffdZdededeeefdGdfdZde eefdGeeeezezezffdZ ddedededzdGefdZejddgdudve)fdZejddgdudve)dmefdZdedzdGedzfdZeUjeUjeUjeUjfZeed<deedddGeUdzfdZ ddedzdefdzdeezdzdeddGedzf dZdedzdGe eeffdZde eefdedzdedzdGe eeffdZdededzdGdfdZejddgdu ddve)dedzdedzdedzdedzdjedzf dZ ddefdefdzdeddeddGef dZdededGeeeeeeeeffdZdGedfdZdGedfdZdGeeeffdZdededzdedzdedGef dƄZdve)defdefdzdededGeeezedzedzeOdzff dDŽZdȄZdeYeTzdeefd˄Zd̄ZdedzdedzdedeqdedGeTdzf dЄZ ddeezezdedeqdededzde\dzdedzdGeTeYzdzfdӄZdedzdGefdՄZdedeefdzdedzdedzdGeeeffdׄZdefdzdedzdeTeYzdzdedeqde\dzdGdfdلZdeTeYzdzde\dzdGe\dzfdڄZdedededzfd܄Zejddgduddve)dedzfd߄Zejddgduddve)dedzfdZejddgdudve)fdZejddgdudve)fdZdeezdedGe\dzfdZde eefdGefdZdede edGeed\fdzfdZ de edGeefdZ dededzdGedzfdZ ddddve)ded|edeezdede\dzdedeqde:dededzdeOdzfdZ ddve)dedzdeezdzdedzdedzdeOdzf dZ ejddgdude'dfdededzdedzfdZ ddeezdzde\dzdGeYfdZejddgdue&ehgdve)fdZejddge&ehgdZdedGefdZdedzdedGe-dzfdZde*dedzdGdfdZGddZGd d ZGd d Zejd dgdudve)fdZejddgdudve)fdZy(a^ Has all /sso/* routes /sso/key/generate - handles user signing in with SSO and redirects to /sso/callback /sso/callback - returns JWT Redirect Response that redirects to LiteLLM UI /sso/debug/login - handles user signing in with SSO and redirects to /sso/debug/callback /sso/debug/callback - returns the OpenID object returned by the SSO provider N)MappingSequence)deepcopyescape)MappingProxyType) TYPE_CHECKING AnnotatedAnyFinalLiteralNoReturnOptionalProtocolUnioncastoverload)parse_qs urlencodeurlparse) APIRouterDependsHeader HTTPExceptionRequestResponsestatus)RedirectResponse) BaseModelBeforeValidator ConfigDict TypeAdapterValidationError)verbose_proxy_logger)uuid) DualCache) CLI_SSO_CLAIM_MAPCLI_SSO_CLAIM_MAX_SCALAR_LENGTH CLI_SSO_SESSION_CACHE_KEY_PREFIXCLI_SSO_SESSION_TTL_SECONDSLITELLM_CLI_SOURCE_IDENTIFIERLITELLM_UI_SESSION_DURATIONMAX_SPENDLOG_ROWS_TO_QUERY%MICROSOFT_USER_DISPLAY_NAME_ATTRIBUTEMICROSOFT_USER_EMAIL_ATTRIBUTE#MICROSOFT_USER_FIRST_NAME_ATTRIBUTEMICROSOFT_USER_ID_ATTRIBUTE"MICROSOFT_USER_LAST_NAME_ATTRIBUTE)get_nested_value)AsyncHTTPHandlerget_async_httpx_clienthttpxSpecialProvider)SSOIdentityAssertionassertion_from_sso_login%retain_sso_identity_assertion_for_ema) CommonProxyErrorsLiteLLM_UserTableLitellmUserRolesMemberNewTeamRequestNewUserRequestNewUserResponseProxyErrorTypesProxyExceptionSSOUserDefinedValuesTeamMemberAddRequestUserAPIKeyAuth)ExperimentalUIJWTTokenget_user_object)_get_request_ip_address_has_user_setup_sso JWTHandler)user_api_key_auth)admin_ui_disabledshow_missing_vars_in_env)jwt_display_template)build_ui_login_form)UserApiKeyCache)new_user)CustomMicrosoftSSO)SAMLAuthHandler)check_is_admin_only_accesshas_admin_ui_access)new_teamteam_member_add) CustomOpenIDget_litellm_user_roleis_valid_litellm_user_role) PrismaClient ProxyLoggingget_custom_urlget_server_root_path) TableActions)SSOConfigRepository)TeamRepository)UserRepository)get_secret_boolget_secret_str str_to_bool)*)DefaultTeamSSOParams)MicrosoftGraphAPIUserGroupDirectoryObject"MicrosoftGraphAPIUserGroupResponseMicrosoftServicePrincipalTeam RoleMappings TeamMappings)ParsedOpenIDResult)OpenID)r router>id_token access_token refresh_token_OAUTH_TOKEN_FIELDSz:flow_CLI_SSO_FLOW_CACHE_KEY_PREFIXz:start_rate_limit*_CLI_SSO_START_RATE_LIMIT_CACHE_KEY_PREFIX<(_CLI_SSO_START_RATE_LIMIT_WINDOW_SECONDS&_CLI_SSO_START_RATE_LIMIT_MAX_ATTEMPTS ABCDEFGHJKLMNPQRSTUVWXYZ23456789_CLI_SSO_USER_CODE_ALPHABETz^cli-[A-Za-z0-9_-]{12,124}$_CLI_SSO_LOGIN_ID_REz^[z]{4}-[z]{4}$_CLI_SSO_SCALAR_TYPESz^[A-Za-z0-9_.-]+$_CLI_SSO_DEST_KEY_RE>secretapi_keyrqpassword private_keyrr client_secretrs_CLI_SSO_SECRET_KEY_FRAGMENTSc2eZdZedeeefdzfdZy)_UserMetadataRowreturnNcyNselfs n/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/management_endpoints/ui_sso.pymetadataz_UserMetadataRow.metadatas7:)__name__ __module__ __qualname__propertyrstrobjectrrrrrrs# :'#v+.5::rrreporTableActions[_UserMetadataRow]c.td|jS)Nrrtablers r _user_meta_dbrs ($** rc2eZdZedeeefdzfdZy) _SsoConfigRowrNcyrrrs r sso_settingsz_SsoConfigRow.sso_settingss;>r)rrrrrrrrrrrrrs# >gc6k2T9>>rrTableActions[_SsoConfigRow]c.td|jS)Nrrrs r_sso_config_dbrs %tzz rc"eZdZdeeeffdZy)_TeamDetailRowrcyrrrs r model_dumpz_TeamDetailRow.model_dumprN)rrrrrrrrrrrrs5GCK05rrzTableActions[_TeamDetailRow]c|jSr)rrs r_team_detail_dbrs ::r_MODEL_ALIASES_ADAPTER_SSO_TOKEN_CLAIMS_ADAPTERvaluecpt|ts|S tj|S#t$rYywxYw)zT``/team/new`` stores team model aliases as a JSON-encoded string in the Json column.N) isinstancerr validate_jsonr#rs r_decode_model_aliasesrs9 eS ! %33E:: s ) 55cTeZdZUedZdZeeeefdze e fe d<y)_TeamModelAliasTabler)protected_namespacesN model_aliases) rrrr! model_configrr rrr r__annotations__rrrrrs426LaeM9WS#X.5G\7]]^errcXeZdZUeed<dZedzed<dZeedfed<dZe dzed<y)_TeamRowGrantsteam_idN team_aliasr.modelslitellm_model_table) rrrrrrrtuplerrrrrrrs8 L!Jd ! FE#s(O 7;-4;rrcleZdZUdZdZedzed<dZedzed<eedfed<dZ e eefdzed<y)CliSsoTeamDetailzOThe per-team snapshot cached in the CLI SSO flow and echoed to the CLI on poll.Nrr. team_modelsteam_model_aliases) rrr__doc__rrrrrrrrrrrrsHYGS4Z!Jd !sCx 37S)D07rr._CLI_SSO_TEAM_DETAILS_ADAPTERr)r_TEAMLESS_CLI_SSO_TEAM_DETAILc"eZdZdededzfdZy)_CustomSsoCall sso_responserNc Kywrr)rrs r__call__z_CustomSsoCall.__call__ss)rrrrrCrrrrrrsV6V6JT6QVrrceZdZdedefdZy)_ServicePrincipalAssignmentkeyrcyrrrrs rgetz_ServicePrincipalAssignment.getrrN)rrrrrrrrrrs's's'rrcbeZdZededdeddedfdZededdedzfd Zy) _ServicePrincipalPagerrdefaultrrcyrr)rrrs rrz_ServicePrincipalPage.gets 36r@odata.nextLinkNcyrrrs rrz_ServicePrincipalPage.getsBEr)rrrrr rrrrrrrrse 6 W 6786 / 0 66 Ew01EcDjEErrc|Srrrs r _as_objectr s Lrrcftj|jdjS)Nutf-8)hashlibsha256encode hexdigest)rs r_hash_cli_sso_secretr s# >>&--0 1 ; ; ==r user_codecNdjd|jDS)Nc3BK|]}|js|ywr)isalnum.0chs r z/_normalize_cli_sso_user_code..sB"RZZ\2Bs)joinupperrs r_normalize_cli_sso_user_coders 77B  1B BBrc^djdtdD}|ddd|ddS)Nrc3NK|]}tjtywr)secretschoicer|)r_s rrz._generate_cli_sso_user_code..s]qw~~.IJ]#%-)rrangers r_generate_cli_sso_user_coders:ww]TYZ[T\]]Im_Aim_ --rlogin_idctd|S)N:)rurs r_get_cli_sso_flow_cache_keyrs, -Qxj 99rcbt|txrttj |Sr)rrboolr} fullmatchrs r_is_valid_cli_sso_login_idrs% h $ W.B.L.LX.V)WWrcbt|txrttj |Sr)rrr_CLI_SSO_USER_CODE_RErrs r_is_valid_cli_sso_user_coder"s% i % Z$/D/N/Ny/Y*ZZrcDddlm}t|jddS)Nrgeneral_settings'allow_cli_sso_verification_uri_completeF)litellm.proxy.proxy_serverrrrrs r*_cli_sso_verification_uri_complete_enabledr &s ;  $$%NPUV WWr poll_secretverification_uri_completec4| |||tdS||||tdS)N)rr r expires_in)rr rr r)r*rr rr s r_cli_sso_start_response_bodyr,s;!( &"5   "%>1  rFrequestuse_x_forwarded_forcPt||xsd}t|}td|S)Nrrunknownr)rHrrv)rr client_ipclient_ip_hashs r'_get_cli_sso_start_rate_limit_cache_keyrCs2.wTghuluI0;N8 9>:J KKrcacheczt||}|j|dt}|tkDr t ddy)Nrrrttliz-Too many CLI login attempts. Try again later. status_codedetail)rincrement_cacherxrzr)rrrrate_limit_cache_keycurrent_attemptss r_check_cli_sso_start_rate_limitr%Is[ #J-@#$33  44 @@B  Arct|tr|jdr tddt |s tddt t t|}|j}||j|}n|j|}t|tr ttj|}t|trd|vr#tjd|tdd |S#t$rd}YFwxYw) Nzsk-zYour litellm CLI is out of date and uses a login flow this proxy no longer supports. Upgrade it with `pip install -U 'litellm[proxy]'` and run `litellm-proxy login` again.rzInvalid CLI login session idrpoll_secret_hashzCLI SSO login session not found in cache for login_id=%s. If the proxy runs multiple replicas, a shared Redis cache is required for CLI login to work.aCLI login session not found or expired. Run `litellm-proxy login` again. If this happens immediately after starting a login, the proxy is likely running multiple replicas without a shared cache; configure a Redis cache so every replica can see the login session.)rr startswithrrrr redis_cache get_cacherjsonloads ValueErrordictr$warning)rr cache_keyr+flows r_get_cli_sso_flow_or_raiser4]s (C X%8%8%?i   &h /4RSS24X3FGI**K$$$39-$ djj./D dD !%7t%C$$ F  >   K# D s$C;; D D r3ct|}|j}|,|j|tj|t y|j||t y)Nr)rr+ set_cacher-dumpsr*)rrr3r2r+s r_set_cli_sso_flowr8sO28metadata_key`` pairs, e.g. ``employment_type->acme_employment_type,org_info.department->department``. Destination keys may use an optional ``metadata.`` prefix; values are stored on the LiteLLM user's ``metadata`` JSON column. ,z->rz metadata.)r'stripsplit removeprefixappend) claim_map_rawparsedentry source_claimdest_keys r_parse_cli_sso_claim_maprIs-224M  +-F$$S) 4 E) !&T1!5 h#))+ >>#((5 H MM<2 3 4 MrrHc|rtj|sy|jtfdtD S)NFc3&K|]}|v ywrr)rfragmentlowereds rrz5_is_safe_cli_sso_metadata_dest_key..sU88w&Us)rrloweranyr)rHrMs @r"_is_safe_cli_sso_metadata_dest_keyrPs8 /99(C^^%GU7TUU UUrct|tsyt|tr9t|tkDry|j dr|j ddk\ryy)NFeyJ.T)rr~rlenr(r*countrs r#_is_safe_cli_sso_scalar_claim_valuerWsN e2 3% u:7 7   E "u{{3'71'< rresultct|tr|St|dr"|j}t|tr|SiS)Nr)rr0hasattrr)rXdumpeds r_sso_result_to_dictr\s=&$ v|$))+ fd #M Irdata claim_pathc|sy||vr||Sd}|jd|jd}|Dcgc]}|j|d}}|}|D]}t|tr ||vr||}y|Scc}w)zResolve a dot-notation claim path against an SSO result dict. Unlike ``get_nested_value``, this does not strip a leading ``metadata.`` prefix, since OIDC claims may legitimately use ``metadata`` as a top-level key. N\.rS)replacerArr0)r]r^ placeholderpartspcurrentparts r_get_nested_claim_valuerhs TJK   uk 2 8 8 =E27 8QQYY{C ( 8E 8G gt $dmG  N 9sA5ct|dd}t|tr||vr||St||}||St|tr t||St |}t||S)N extra_fields)getattrrr0rhr\)rXr^rjnested result_dicts r_extract_sso_claim_valuernsr!&.$?L,%  % + +/ jI  M&$&vz::,V4K "; ;;rrkey_pathcd}|jd|jd}|Dcgc]}|j|d}}|}|ddD],}|j|}t|tsi}|||<|}.|||d<ycc}w)Nr`rarS)rbrArrr0) rrorrcrdrerfrgexistings r_set_nested_metadata_valuerssK   UK 0 6 6s ;E27 8QQYY{C ( 8E 8Gcr ;;t$(D)H$GDM  GE"I 9sBc6i}d|fg}|r|j\}}t|tr9|}|jD]#\}}|r|d|n|}|j ||f%n0t|t t ttfrt|r|||<|r|S)zIExpose scalar attribution metadata as a flat dict for CLI poll responses.rrS) poprr0itemsrCrintfloatrrW) r flattenedstackprefixr nested_itemsrrl nested_prefixs r"_flatten_cli_sso_metadata_for_pollr~s=?I/18n-=E   eT "16L+113 6 V5;6(!C5 1  mV45 6S%6 7<_`e#t$r!}tjd||Yd}~yd}~wwxYww)Nrwhere)rrrrr]z6Persisted CLI SSO attribution metadata for user %s: %sz>Failed to persist CLI SSO attribution metadata for user %s: %s)rrc find_uniquerrr0rr update_manyr$infolistr~keys Exceptionerror)rrruser_rowr row_metadatamerged_metadataes r_persist_cli_sso_user_metadatarIs q -n].K L X X`ikr_s X tt/1  "*"3"3L,-$,\$:!!D/!5" N=9:FFg&o.G    !! D  34HINNP Q u  q""#celnoppqsQD)CCA(CC;CDCC D#C?:D?DD session_datac^|jd}t|tr t|SiS)Nr)rrr0r~)rstoreds r+_cli_poll_attribution_metadata_from_sessionrjs/!$$%; LiteLLM CLI Login

Complete CLI Login

z+

r)rrrescaped_verify_urlescaped_browser_complete_tokenuser_code_value_attr instructionss r!_render_cli_sso_verification_pagerss !'z >,23IQU,V"YjHV4ET-R,SST"Upr  D W 5j^''9&:;GGeFfgPPdOefs? ?rz/sso/cli/start experimental)tagsinclude_in_schemac Kddlm}m}t||t |xsij dddt jd}t jd}t}t|tt|dddd }t||| tr7tt|jd d zt!t"||dznd}t%||||Sw)Nr)cli_sso_session_cacherrF)rrrzcli- )r)user_code_hash sso_completeuser_code_verifiedrrrr3zsso/key/generaterequest_base_urlroute?rrrr)r rrr%rrr token_urlsaferrrr8r r^rbase_urlrr+r)rrrrr rr3r s r cli_sso_startrsR## "2"8b!=!=>SUZ![\ W222678H ..r2K24I1=./KI/VW# Dx/D4P 6 7 C0@0@,AI[ \ ;#!*  (";  sC.C0z/sso/cli/complete/{login_id}c Kddlm}ddlm}ddlm}t ||}|jdr|jds tdd |jd{jd }t|}|jd xsd gd}|jdxsd gd} tt|} t| } |jd} t| trt!j"| | s tdd |jd} t| trt!j"| | s tdd d|d<t%||||}||dS7w)Nr HTMLResponse)render_cli_sso_success_pagerrrrrr'zCLI login is not readyrrrrrrzInvalid verification codebrowser_complete_token_hashTrrcontentr )fastapi.responsesr5litellm.proxy.common_utils.html_forms.cli_sso_successrr rr4rrbodydecoderrrrrrr:r8)rrrrrr3r form_valuessupplied_user_codesupplied_browser_complete_tokensupplied_user_code_hash$supplied_browser_complete_token_hashexpected_user_code_hash$expected_browser_complete_token_hash html_contents rcli_sso_completerso.A,hF[\D 88N #488N+C4LMM '//8D!$K!,!=!E"q I.9oo>V.W._\^[_ab-c#%9:VWi:j%k2FGf2g(%)XX.>%? -s 37;Q;Q!8<4OPP26((;X2Y( :C @H^H^,.RI4OPP!%D x/D4P57L  # >>/(sA"F$F%DFemailcL|yt|tr|jS|S)a Normalize email address to lowercase for consistent storage and comparison. Email addresses should be treated as case-insensitive for SSO purposes, even though RFC 5321 technically allows case-sensitive local parts. This prevents issues where SSO providers return emails with different casing than what's stored in the database. Args: email: Email address to normalize, can be None Returns: Lowercased email address, or None if input is None N)rrrN)rs rnormalize_emailrs& }&uc25;;===rLITELLM_USER_ROLE_HIERARCHY user_groups role_mappingsrlc|js |jSt|tr t |n t }t D]q}||jvs|j|}t|ts2|j t |sMtjd||j||cStjd||j|jS)a Determine the highest privilege role for a user based on their groups. Role hierarchy (highest to lowest): - proxy_admin - proxy_admin_viewer - internal_user - internal_user_viewer Args: user_groups: List of group names from the SSO token role_mappings: RoleMappings configuration object Returns: The highest privilege role found, or default_role if no matches, or None z/User groups %s matched role '%s' via groups: %szFUser groups %s did not match any role mappings, using default_role: %s) roles default_rolerrsetr intersectionr$rr)rruser_groups_setrole role_groupss rdetermine_role_from_groupsr4s(   )))2| j#d Dcgc]#}|j%s|j%%} }n| t!| g} | r$t'| |} t j d | | n|j(r |j(} | Ft+j,d d }t||}|"t/|} t j d | || 9t |tr| |d<n t|d| t j d| |Sy#|jj$rt j dYywxYwcc}wcc}w)a Process SSO JWT access token and extract team IDs and user role if available. This function decodes the JWT access token and extracts team IDs and user role, then sets them on the result object. Role extraction from the access token is needed because some SSO providers (e.g., Keycloak) do not include role claims in the UserInfo endpoint response. Args: access_token_str: The JWT access token string sso_jwt_handler: SSO-specific JWT handler for team ID extraction result: The SSO result object to update with team IDs and role role_mappings: Optional role mappings configuration for group-based role determination Returns: The decoded access token payload dict, or None if decoding failed or inputs were missing. Callers can pass this to _sync_user_role_from_jwt_role_map so it has access to custom role claims (e.g. custom_roles) that are encoded inside the JWT but stripped from received_response. rNverify_signatureFoptionszYAccess token is not a valid JWT (possibly an opaque token), skipping JWT-based extractionteam_ids user_roler?zFDetermined role '%s' from access token groups '%s' using role_mappingsGENERIC_USER_ROLE_ATTRIBUTErz0Extracted role '%s' from access token field '%s'z(Set user_role='%s' from JWT access token)jwtr exceptions DecodeErrorr$rrr0rget_team_ids_from_jwtrksetattrr group_claimr3rrrAr@rrosgetenvrZ)rrrXrraccess_token_payloadresult_team_idsr existing_rolerruser_groups_rawr raw_groupsg generic_user_role_attribute_nameuser_role_from_tokens rprocess_sso_jwt_access_tokenrbsz4F *4#**5EPbdiOj*k  &$'4:JJz24N&.DDEYZH)1F:&EK'&*b"AQS&.DDEYZHFJ94>fd3K ;/QXY_alnrQs  15I(]-@-@%2%>%> 1ABVXc1d)+ ot4:IJ3=">a3q6">K">56E6K6KC6P"^TUT[T[T]1779"^K"^$0#&#7"8K :; VI(..`bkmx#// - : :I :<))Daci:j0.>?SUu.v$'3 56J KI(..JIWw$fd+*3F;'FK;$**+UW`a## C~~))  & &k   @#?"^s#H6I*9I/I/6.I'&I'tokenc |s tiS ttjtj|ddiS#tj j tf$r#tjdticYSwxYw)NrFrz7SSO token is not a decodable JWT, skipping token claims) rrvalidate_pythonrrrInvalidTokenErrorr#r$r)rs r_decode_sso_token_claimsrs| ##$ % 5 5cjjQcejPk6l m   NN , ,o >$""#\]##$s4AAB  B userinforqrrc |t|t|f}td|D}t|Dcic]tfd|Ddc}Scc}w)Nc3.K|] }|D]}|ywrrrrrs rrz*_merge_sso_token_claims..s"O6"O3"O3"Osc3LK|]}|j|ywr)rrs rrz*_merge_sso_token_claims..s"UFC9TF3KUs$ $)r frozensetrnext)rrqrrsources claim_namesrs `r_merge_sso_token_claimsrs`  8 BD\]iDjkG""OW"OOK hstaddUgUW[\ \t tsA premium_usercLK|dury|Cttjjtj dt jt|jd{}|r1|dkDr+tdtj dt jyy78w)z\Free tier allows SSO for up to 5 billable users; beyond that requires an Enterprise license.TNrmessagetypeparamcodeaYou must be a LiteLLM Enterprise user to use SSO for more than 5 users. If you have a license please set `LITELLM_LICENSE` in your env. If you want to obtain a license meet with us here: https://enterprise.litellm.ai/demo You are seeing this error message because You configured SSO (one of `MICROSOFT_CLIENT_ID`, `GOOGLE_CLIENT_ID`, `GENERIC_CLIENT_ID`, or SAML) in your env. Please unset it) rBr:db_not_connected_errorrrA auth_errorrHTTP_403_FORBIDDENrccount_billable_users)rrbillable_userss r%_raise_if_sso_exceeds_free_user_limitrst%<<BB ++ **   #1"?"T"T"VVN.1,_ ++ **   -~WsA'B$)B"*9B$z/sso/key/generaterr existing_key return_tocKddlm}m}m}m} m} m} tjdd} tjdd} tjdd}tjd}|t|}|r tS| | |tjrt|| d{t}||Stj!|d }|t"k(r t%|| tj'||t)r|nd }| ! dd lm}|j/|d{S| M| K|Itjr5t5j6dtj8|| |d{Stj;| | |durIt5j6d|tj=|| | |||d{}| t?|||Sddl m!}tjddjEdk(xs|jGdddu}|tId|d}t?|||S77 #t0$r t3dwxYw77w) Create Proxy API Keys using Google Workspace SSO. Requires setting PROXY_BASE_URL in .env PROXY_BASE_URL should be the your deployed proxy endpoint, e.g. PROXY_BASE_URL="https://litellm-production-7002.up.railway.app/" Example: r)rrrruser_api_key_cache"user_custom_ui_sso_sign_in_handlerMICROSOFT_CLIENT_IDNGOOGLE_CLIENT_IDGENERIC_CLIENT_IDDISABLE_ADMIN_UIr sso/callbackrsso_callback_routerr)EnterpriseCustomSSOHandler)rzYEnterprise features are not available. Custom UI SSO sign-in requires LiteLLM Enterprise.zRedirecting to SAML SSO loginrr relay_statemicrosoft_client_idgoogle_client_idgeneric_client_idTzRedirecting to SSO login for %s) redirect_urlr.r/r0staterr%LITELLM_HIDE_DEFAULT_CREDENTIALS_HINTfalsetruehide_default_credentials_hintF)show_deprecation_bannerr6rr)%r rrrrr!r"rrrfrMrTis_saml_configuredrrNSSOAuthenticationHandlerget_redirect_url_for_ssor+r4_get_cli_stater 0litellm_enterprise.proxy.auth.custom_sso_handlerr*handle_custom_ui_sso_sign_in ImportErrorr/r$rbuild_login_redirectshould_use_sso_handlerget_sso_login_redirect_persist_return_to_cookierrrNrrP)rrrrrrrrrrr!r"r.r/r0_disable_ui_flag is_disabledmissing_env_varsr1 cli_stater* sso_redirectrr6 form_responses r google_loginrIs"$+@$!G ii(:DA!yy). 97CIIKvU P    ? G4 O"(#$(*G  MmY7 w Q< k    s^B+I.-I .A%I.I/I0I3A I.>I*?AI.I,A;I.II''I.,I. jwt_handler team_mappingsrmc .tjdd}tjdd}tjdd}tjdd}tjd d } tjd d } tjd d} tjdd} tjd||g} |0|j t t |}| j||g|j[tt t ||jg}|rc| j|tjd|j|n0|j t t |}| j|d}||jjdvr|j}t||}g}t|tr|}|Dcgc] }t|}}n\t|tr>|j!dDcgc]#}|j#s|j#%}}n| t|g}|r2t%||}tjd|r |j&nd|n-|j(}tjd||j(|>t|| }|0t+|}|#|}tjd|j&| d}| r7i}| j!dD]!}|j#}t||||<#t-t||t||t/t||t||t|| t|| | || Scc}wcc}w)NGENERIC_USER_ID_ATTRIBUTEpreferred_username#GENERIC_USER_DISPLAY_NAME_ATTRIBUTEsubGENERIC_USER_EMAIL_ATTRIBUTEr!GENERIC_USER_FIRST_NAME_ATTRIBUTE first_name GENERIC_USER_LAST_NAME_ATTRIBUTE last_nameGENERIC_USER_PROVIDER_ATTRIBUTEproviderrrGENERIC_USER_EXTRA_ATTRIBUTESzJ generic_user_id_attribute_name: %s generic_user_email_attribute_name: %s)r]rorzALoaded team_ids from DB team_mappings.team_ids_jwt_field='%s': %s)genericoktar?z9Determined role '%s' from groups '%s' using role_mappingsz/No groups found in '%s', using default_role: %sz9Found valid LitellmUserRoles '%s' from SSO attribute '%s') id display_namerrSrUrWrrrj)rrr$rget_all_jwt_team_idsrr0extendteam_ids_jwt_fieldr3rWrNrrrrrAr@rrrrZrYr)responserJrrrKgeneric_user_id_attribute_name(generic_user_display_name_attribute_name!generic_user_email_attribute_name&generic_user_first_name_attribute_name%generic_user_last_name_attribute_namegeneric_provider_attribute_namergeneric_user_extra_attributes all_teamsrteam_ids_from_db_mappingrrrrrruser_role_from_ssorrj attr_names rgeneric_response_convertorrlys-/II6QSg,h"68ii@egl6m,/1yy9WY`/a%46II>aco4p*3599=_al3m)-/YY7XZd-e#.0ii8UW].^$+-995TVZ+[!U&) I""77T88LM" ]%E%E%QParse comma-separated GENERIC_SSO_HEADERS env var into a dict.GENERIC_SSO_HEADERSNr?=)rrrAr@)rawrXheaderrrs r_parse_generic_sso_headersrsi0$7C { $&F))C.  c*JCF3K  Mrrrradditional_headersct|}tjddjdk(}|sd|vsd|jvrt|xrd|jvxs|xrd|jv}|rdnd}d |d }|r|d z }|d |z }t |t j dtj t|trtjd|||tjd|||)zDHandle errors from generic SSO verify_and_process. Always re-raises.GENERIC_CLIENT_USE_PKCEr4r5PKCEz code verifierrZOktazYour OAuth providerzSSO authentication failed: z requires PKCE (Proof Key for Code Exchange) but it's not enabled in your LiteLLM configuration. SOLUTION: Add this environment variable and restart your proxy: GENERIC_CLIENT_USE_PKCE=true zFor AWS ECS: Add the environment variable to your task definition. For Docker: Add -e GENERIC_CLIENT_USE_PKCE=true to your docker run command. For .env file: Add GENERIC_CLIENT_USE_PKCE=true to your .env file. zOriginal error: rz4SSO authentication failed: %s. Passed in headers: %szEError verifying and processing generic SSO: %s. Passed in headers: %s) rrrrNrBrArrHTTP_401_UNAUTHORIZEDrr$r exception) rrrr error_messagepkce_configuredis_okta provider_namedetailed_messages r_handle_generic_sso_errorrs?q6M  YY'@'JPPRV\\O - 7?mNaNaNc;c8mVGeGkGkGm=m " Ov1G1M1M1O'O *1v6K *-91 2   Y   .}o>>$ +++--   !^$"" B   G && S  Grc p !Kddlm}ddlm}dd}t ||\}} } } } } || | | }t d{ t d{!tjddjdk(dtttfd tf !fd }|d || }||||d | tjdt}d}d} t j#|| d{}|j%dd}|j%dd}|j&j)d}|r|j&j)d}|j*j)d}|r|rt-j.||s+t1dt2j4dt6j8|s+t1dt2j4dt6j8|s+t1dt2j4dt6j:| s+t1dt2j4dt6j:t=|ts+t1dt2j4dt6j8t j?||||| | | || d{}||}tA|j)d|j)d}|j)d }nHjC|||!d{}jD}tAjFjH}tK|| "}|rt jM|d{tjd#|xsi||fS7>7/77771#tN$r}tQ|| | |Yd}~Kd}~wwxYww)$NrDiscoveryDocumentcreate_providerauthorization_endpointtoken_endpointuserinfo_endpointGENERIC_INCLUDE_TOKEN_CLAIMSr4r5r` httpx_sessioncr|jd}|jd}t|tr|r|n j}t|tr|r|n j} rt |||n|}|j Dcic]\}}|tvs||c}} t|  Scc}}w)Nrqrr)rrqrr)r`rJrrrK) rrrrqrrrrvrtrl)r`rresponse_id_tokenresponse_access_tokenrqrrclaimsrrgeneric_include_token_claims generic_ssorJreceived_responserrrKs rresponse_convertorz4get_generic_sso_response..response_convertors#+<< #;'/||N'C!+,=s!CHY _j_s_s  /5:O ")) , $!!)   *0 %33FY;YCJ *#+''    s B3B3oidc)namediscovery_documentrT client_idr redirect_uriallow_insecure_httpscopez&calling generic_sso.verify_and_process)rr code_verifier_pkce_cache_keyrr2litellm_oauth_stateuPInvalid OAuth state parameter — does not match the browser-bound state cookie.rz&Missing authorization code in callbackz2GENERIC_CLIENT_ID must be set when PKCE is enabledr%z7GENERIC_TOKEN_ENDPOINT must be set when PKCE is enabledrs) authorization_coderrrrrinclude_client_idr1rrqrsrr)paramsheaders)rzgeneric result: %s))fastapi_sso.sso.baserfastapi_sso.sso.genericrrrrrrrNrrrr$rrr9!prepare_token_exchange_parametersru query_paramsrcookiesrr:rBrArrHTTP_400_BAD_REQUESTrr_pkce_token_exchanger8verify_and_processrrrqrsr_delete_pkce_verifierrr)"rrJrr0r1rr sso_assertionr}r~rrrr discoveryr SSOProvider#additional_generic_sso_headers_dictrrtoken_exchange_paramspkce_cache_keyr url_state cookie_statecombined_responserXrrrrrrrKs" `` @@@@@rget_generic_sso_responsers77%)15M $$5|D&!!)=-3I "6!77M!5!77M*,))4RT[*\*b*b*dhn*n  WS&[%9 &  @) $-K %#+!  KGH1K1M' $M(,m -E-g-g&?.h. (  .11/4H 5 9 9:KT R %,$8$8$<$N ?F$N#N $A NNANNN#!N6N6 N NNN N3N.)N6.N33N6c K t|jd}t||}t|t t j d{S7#t$r }tjd|Yd}~yd}~wwxYww)z,Create a task for adding a member to a team.user)rr)memberrrr]user_api_key_dictN5[Non-Blocking] Error trying to add sso user to db: %s) r=rrDrXrEr< PROXY_ADMINrr$r)r user_inforteam_member_add_requestrs rcreate_team_member_add_taskrs _y'8'8vF)=* %(,7G7S7ST     _""#Z\]^^_sABA AAABA B A;6B;BBr sso_teamscVK|j |jng}t|t|z }t|}g}|Dcgc]}t||}} t j |d{ycc}w7 #t $r }tjd|Yd}~yd}~wwxYww)zq - Get missing teams (diff b/w user_info.team_ids and sso_teams) - Add missing user to missing teams Nr) teamsrrrasynciogatherrr$r)rr user_teams missing_teamsmissing_teams_listtasksrrs radd_missing_team_memberrs ,5??+F BJy>C O;M $] 3 EL^ _ () < _E __nne$$$ ` % _""#Z\]^^_sNAB)A6B)A=0A;1A=5B);A== B&B!B)!B&&B)ctj}|y|jdxsi}|jdxsg}td|vS)NFpersonal_key_generationallowed_user_roles proxy_admin)litellmkey_generation_settingsrr)rrrs r,get_disabled_non_admin_personal_key_creationrsX%,%D%D&%<%@%@AZ%[%a_a 7 ; ;

9F>FFsso_rolecN|yt|stjd|yy)zLreturns true if SSO upsert should use the 'role' defined on the SSO responseFz{SSO role '%s' is not a valid LiteLLM user role. Ignoring role from SSO response. See LitellmUserRoles enum for valid roles.T)r[r$r)rs r"_should_use_role_from_sso_responsers2 %h /"" J   rrYcdt|i}t|dd}|Et|tr |jn|}t |r||d<t jd|||S)aI Build the update data dictionary for SSO user upsert. Args: result: The SSO response containing user information user_email: The user's email from SSO user_id: The user's ID for logging purposes Returns: dict: Update data containing user_email and optionally user_role if valid rrNz"Updating user %s role from SSO: %s)rrkrr<rrr$r)rXrr update_datar sso_role_strs r_build_sso_user_update_datar)sm .:?:;V,WKfk48H0:8EU0Vhnn\d  .l ;'3K $ % %&JGUa b rrc>K||y|jjsy|jjsy|j|}|yt j d|j ||j |d<||j|j k7rtt|jd|jid|j id{|j |_|j|j|td{yyy7B7 w)aY Apply jwt_litellm_role_map during SSO login. When jwt_litellm_role_map is configured with sync_user_role_and_teams=True, this ensures SSO users get the same role mapping as API/JWT users. Without this, the SSO path falls back to INTERNAL_USER_VIEW_ONLY for roles that don't directly match LitellmUserRoles enum values. Nz)SSO jwt_litellm_role_map matched role: %srrr)rr model_type)litellm_jwtauthsync_user_role_and_teamsjwt_litellm_role_mapmap_jwt_role_to_litellm_roler$rrrrrcupdaterasync_set_cacher;)rJrrrr!r mapped_roles r!_sync_user_role_from_jwt_role_mapr Is4 /7  & & ? ?  & & ; ;$AABSTKI;K\K\]&+6+<+<K(!4!4 8I8I!IN=9:AAi//0{001B   *//  00!!(1   "J  s$CDD:DDDDc|y||j|j|d<|jd}|r |jnd}t|rt j d||np| |j3t jj|d<t jdn/|j|d<t jd|j|'t|dr|jr|j|d<|S)Nrrz$Using SSO role: %s (DB role was: %s)z?No SSO or DB role found, using default: INTERNAL_USER_VIEW_ONLYzUsing DB role: %sr) rrrrr$rr<INTERNAL_USER_VIEW_ONLYrrrZr)rrrdb_roles r1apply_user_info_values_to_sso_user_defined_valuesr$xs"!2!2!>)2):):I&*--k:H,5Y((4G)(3!!"H(T[\   3 3 ;/?/W/W/]/]  , & &'h i/8/B/B  , & &':IEE '*!#3#?#?#E#EFF   %0066  sBB)B'!B)z /sso/callbackr2c >Ktjd||jjd}|rS|jjd}tjd||t dd||r d|z dz d d lm}d d lm }d d l m }d dl m }m}m} m} m} | %t dt$j&j( d} |jdd} | St+| t,rC|} | j/| | ||jdijddd t1j2dd}t1j2dd}t1j2dd}d}d}d}| +t5dt6j8dt:j<t>jA|d}tjd|d}|!tBjE|||d{}nB|!tFjI|||d{}n|tK||||| d{\}}}}| t dd! |r~|jM|d"rj|jOd"d#}tQ|d$kDr|d$nd}tQ|d#kDr|d#nd}tjd%tS||||||&d{S|jTjd'}t>jW||||| ||||( d{S7777L7 w))z Verify loginz$Starting SSO callback with state: %srerror_descriptionz6SSO callback received OAuth error: %s, description: %sz OAuth error: z, error_description: rrr LITELLM_CLI_SESSION_TOKEN_PREFIXLiteLLM_JWTAuthrJ)rrJ master_keyrr!Nui_access_modesso_group_jwt_fieldr_rr!rleewayr#r$r%zMaster Key not set for Proxy. Please set Master Key to use Admin UI. Set `LITELLM_MASTER_KEY` in .env or set general_settings:master_key in config.yaml. https://docs.litellm.ai/docs/proxy/virtual_keys. If set, use `--detailed_debug` to debug issue.r0rr'r(Redirecting to %s)rr/r1)rr.r1rrJr0r1rz$Result not returned by SSO provider.rrTrzCLI SSO callback detected)rrrrXrrlitellm_cp_return_to) rXrrr0r2rrJrr),r$rrrr1rlitellm.constantsr-litellm.proxy._typesr/litellm.proxy.auth.handle_jwtrKr rrJr0rr!r:rrrr0update_environmentrrrBrArrr|r9r:GoogleSSOHandlerget_google_callback_responseMicrosoftSSOHandlerget_microsoft_callback_responserr*rArUcli_sso_callbackr!get_redirect_response_from_openid)rr2 oauth_erroroauth_error_descriptionr-r/rKrrJr0rr!rr2r.r/r0rrrr1rX state_partskey_idr cp_return_tos r auth_callbackrIsDeL --11':K)0)=)=)A)ABU)V$$ DkSj ";-0D[&'>&?@e  bde  C484E4\4\4b4bcc)-O,001A4HN!j&F$,**'1+#3#7#78H"#M#Q#QRgim#n + "$+@$!G ii(:DA!yy) AD585E5I;q>t!!"=>%//'    '.oo&9&9:P&QL)KK++%1#L   i   *  s\G8L:L;"LLL8L9BL L AL LLLLLLz/sso/saml/logincKddlm}tjd}|t |r t St j|||d{S7w)zBSP-initiated SAML login. Redirects the user to the configured IdP.rr!r&Nrr+)r r!rrrfrMrTr?)rrr!rCs r saml_loginrL/sO> ii(:;# :J(K "" 55gM_mvw ww wsAAAAz/sso/saml/metadatacrKddlm}tj||d{}t |dS7w)zEService Provider metadata XML, for registering this proxy at the IdP.rrK)rrNzapplication/xml)r media_type)r r!rTbuild_sp_metadatar)rr!rs r saml_metadatarP;s5>+==gUghhH H1B CCis !757z/sso/saml/callbackc Kddlm}m}m}m}m}m}tjd}|t|r tS|%tdtjj|+tdt j"d t$j& t)j*|d{}d |vr td d t)j,|||d{} t/||d{|j1dd} |j1d} t3| t4rt6j9| r| nd} t6j;| |dd| d|| d{S777y7 w)zPAssertion Consumer Service. Validates the IdP assertion and issues a UI session.r)rrJr0rrr!r&Nrr1rzmMaster Key not set for Proxy. Set `LITELLM_MASTER_KEY` in .env or general_settings:master_key in config.yaml.r0r SAMLResponser'z)Missing SAMLResponse in callback request.)rr post_datar2 RelayState)rXrrr0r2rrJr)r rrJr0rrr!rrrfrMrr:rrrBrArrr|rTread_acs_post_data handle_acsrrrrr9_validate_return_torC) rrrJr0rrr!rCrSrXr2r,rHs r saml_callbackrXDss!ii(:;# :J(K ""4E4\4\4b4bccD ++66   -??HHIY&4_``)44WL^jsttF / m LLL,001A4HN"|4K k3 ',D,X,XYd,e   *KK%!L   !IuL sIB*E/,E'-0E/E)E/1E+2A0E/"E-#E/)E/+E/-E/parsed_openid_resultc @Kddlm}|}|jd}|0tj|r||d{St d|yt g||jdtj|jdtjS7]w)Nr)user_custom_ssor,user_custom_sso must be a coroutine functionrrrrr max_budgetrbudget_duration) r r[rinspectiscoroutinefunctionr/rCrmax_internal_user_budgetinternal_user_budget_duration)rXrYr[custom_sso_handlerrs r"_build_cli_sso_user_defined_valuesrezs;7F)--i8G%  & &'9 :+F33 3GHH '++L933&**;7==   4s.sZ%h&9&9&;<Zr)rrb find_manyrr$rr)rr prisma_teamsrs rfetch_cli_sso_team_detailsrrs $3N=4Q$R$\$\tUm,*D1%]%   Z\Z ZZ  ""#XZ[\s=A:.AA AA: A A7A2-A:2A77A: team_detailscZ|Dcgc]}|j|jc}Scc}w)a7The teams a login may bind to: only those whose row still exists. A team deleted out from under a membership, which is what deleting an organization leaves behind, can never resolve its grants, so offering it would refuse every future login for that user with nothing they could do to recover. r)rsr!s r_cli_sso_session_teamsrvs%*6 Tv9SFNN TT Ts((rctS tj|}t fd|DdS#t$rYywxYw)z``None`` means the team's grants are unknown. An empty grant is a real value meaning unrestricted, so an unknown one must not be minted as empty.Nc3BK|]}|jk(s|ywrru)rr!rs rrz/selected_cli_sso_team_detail..sKF71JKs)rrrr#r )rsrdetailss ` rselected_cli_sso_team_detailrzsN,,6FF|T KgKT RR s5 AA)rrrrc Kddlm} |jd} |jd}t|||| ||| d{}| t dd|j s t ddt |j | d{g}t|d r4|jr(t|jtr |jng}t|| d{}| t dd t|}t| }|r.t|tt |j |d{tt |j |j"t|dr |j$ng|||Dcgc]}|j'c}|d|d<d|d<t)j*d}t-||d<t/|||t1j2d|j |t5|t7t!|j8d|}| t;||| dS777^7 cc}ww)NrrrrrXrr!rrrrr1z,Failed to retrieve user information from SSOrr assertionr)rrzDCould not resolve team model grants for this login. Please try again)rX)rrrr)rrrrrrsrrTrrrrz=Stored CLI SSO session for user: %s, teams: %s, num_teams: %szsso/cli/complete/r)rrrrr)rrrrrrr9rZrrrrrrvrrrrrrrrrrr8r$rrUr^rr)rrr3rXrYrrr!rrrrrrrrrrsresolved_teamsrr!rrs r"_complete_cli_sso_callback_sessionrsO/)--i8G,00>J2#-+/!I4bcc   4bcc / 8I8IUb cccEy'"y#-ioot#D " :^c ddLY  3<@N"DF"S,'i//0!5   Y../((&-i&B)"" ;GH**,H 4D D$+$9$9"$=*>?U*VD &'s*?dKG N  'W--.!#'J 1!#9/   wd e Is^>IH6AIH9AIH<AI4H?5AI<IB$I9I<I?IIcKtjdddlm}m}m}m} m} t||} |%tdtjj| tddtttz|} t j#| t%j&d d } tj(d | t+| | d{}t j-|| | t/|tt0|| | | ||| || || d{S7I7#t2$rt$rt4$r+}tj6d|tdd|d}~wwxYww)zDCLI SSO callback - stores session info for JWT generation on pollingzCLI SSO callbackr)rrrrr!rNr1rz&a&a" ii(;TB'b'  ""#=?ST+M"!5, &  !DD-"/ E 8S#"!5 3'1"7//'   &      W""#DaH6QRSQT4UVVWsPA>E)AD DAD DD E)D D E&;&E!!E&&E)z/sso/cli/poll/{key_id})rrGx_litellm_cli_poll_secretc Kddlm}ddlm} t ||}t ||s t dd|jd r|jd sd d iS|jd }t|tr|jdg}|jd}|d} tjd| ||t||lt|dkDr^tjd| |d} t|tr|r|} n|r|D cgc]} | dd } } d| || dd} t|} | r| | d<| S|||vr(t dd|d|t|dkDr|dnd}t||}|t dd|dt!| |d |jd!g"}|j"|||j$|j&|j(d#}|j+t-|$tjd%| |d|| |||d&} t|} | r| | d<| Sd d iScc} w#t $rt.$r+}tj0d'|t dd(|d}~wwxYww))a CLI polling endpoint - retrieves session from cache and generates JWT. Flow: 1. First poll (no team_id): Returns teams list without generating JWT 2. Second poll (with team_id): Generates JWT with selected team and deletes session Args: key_id: The CLI login session ID team_id: Optional team ID to assign to the JWT. If provided, must be one of user's teams. r)rFrr)r3r izInvalid CLI polling secretrrrrrrrrsrz:CLI poll: user=%s, team_id=%s, user_teams=%s, num_teams=%sNrz3Returning teams list for user %s to select from: %srrreadyT)rrrrsrequires_team_selectionrzUser does not belong to team: z. Available teams: )rsrr1z-Could not resolve the model grants for team: z. Please run `lite login` againrr)rrr)rrrrrr^r(z(CLI JWT generated for user: %s, team: %s)rrrrrrszError polling for CLI JWT: %szError checking session status: )litellm.proxy.auth.auth_checksrFr rr4r=rrrr0r$rrUrrrzr;get_cli_jwt_auth_tokenrrr delete_cacherrr)rGrrrFrr3rruser_team_detailsrteam_details_responset poll_responser selected_teamr jwt_tokenrs r cli_poll_keyrf s"F@m[0&H]^*B[\C8TU Uxx'txx8L/Mi( ("hh~6 lD ) , 0 0" =J'3'7'7'G ))4G % %LJ  3z?Q#6$))*_ahjtuIM%/6;L,=)Yc,dTU$-O,d),d%&'$9/3 4 (SS_'`$'*Q-D#?.$M$# #J7)Srs 1&{3#''"5 I M5LL#(33)55#0#C#C  I " . .3Nv3V . W % %&PRY[b c! ""#!2 M$O|#\ #8L 45 i( (I-eL  [""#BAF6UVWUX4YZZ[sa I4A H4I4B0H4 H/H46I47C3H4*I4+H4.I4/H44I1&I,,I11I4 result_openidc Ktjd|| tdt|tr t di|}| tdt jrx|jd}t|r=|}|jt j||d<tjd|n|jt j|jdtjjk(rH|jdt j|d<|jdt j|d<|dtj |d<t#|d t%|d |d|d|d|d d }|rt'|d rdt)|d i|_t-|t/tj0d{}|S7w)ar Helper function to create a New User in LiteLLM DB after a successful SSO login Args: result_openid (OpenID): User information in OpenID format if the login was successful. user_defined_values (Optional[SSOUserDefinedValues], optional): LiteLLM SSOValues / fields that were read Returns: Tuple[str, str]: User ID and User Role z+Inserting SSO user into DB. User values: %sNzresult_openid is Nonezuser_defined_values is Nonerz!Preserved SSO-extracted role '%s'r^r_rrF)rrrr^r_rauto_create_keyrW auth_providerrrr)r$rr/rr0rorr rrrr< INTERNAL_USERrrbrcr"r?rrZrkrrRrEr)rrrpreserved_rolenew_user_requestr`s rinsert_sso_userr sLNab011-&// "677++.11+> -h 7$,N  & &w'K'K L/=  , & &'JN [ & &w'K'K L{+/?/M/M/S/SS  " "< 0 8070P0P  -  " "#4 5 =5<5Z5Z  1 2;'/+;+S+SK(,#I."#6|#DE%k2&|4+,=>' 2 ;%4gmZ6X$Y!$ (3C3O3OPH O sGG!GG!z/sso/get/ui_settings)rr dependenciescKddlm}m}tjdd}tjdd}tjdd}t }|j dtkD}|jdd}d tjvr&tjd jd k(rd }||||||j d|d Sw) Nr)r proxy_statePROXY_BASE_URLPROXY_LOGOUT_URLLITELLM_UI_API_DOC_BASE_URLspend_logs_row_countdefault_team_disabledFPROXY_DEFAULT_TEAM_DISABLEDr5T)rrrDEFAULT_TEAM_DISABLED SSO_ENABLEDNUM_SPEND_LOGS_ROWSDISABLE_EXPENSIVE_DB_QUERIES) r rrrrrIget_proxy_state_variabler-renvironrN) rrr_proxy_base_url _logout_url_api_doc_base_url_is_sso_enableddisable_expensive_db_queriesrs rget_ui_settingsr0 sIYY'7>O#5t"E " *    9 :  #    2 3  )')yy1H$'O02 :Z\`0a&(* 2JD(Q+-995PRV+W! (    7 8 ) 1    @ A ! )    8 9 $ ,    ; < <A"+-88:;;VW    !"+-9-88:;;z{|E|EFR|S{TU    sG*G,cv|jdr|jdsd|vrytd|D S)aTrue for a strictly relative return path that stays on the gateway's own origin by construction, and is therefore safe to honor without a configured ``control_plane_url``. Used by the MCP gateway DCR authorize round-trip so a browser sent through login lands back on the authorize request. Requires a single leading ``/`` (not protocol-relative ``//``), no backslash (browsers fold ``\`` to ``/``, so ``/\evil.com`` would escape the origin), and no control or whitespace characters. Rejecting control chars keeps a ``\r\n``/tab-bearing value out of the redirect ``Location`` and the ``litellm_cp_return_to`` cookie entirely, rather than relying on downstream header encoding to neutralize it./z//\Fc3DK|]}t|dkxs|dvyw)r)rqN)ordrs rrz._is_same_origin_return_path.. s%MR3r7T>8R=%88Ms )r*rO)rs r_is_same_origin_return_pathr s=    $ (<(Cross-origin SSO: redirecting to control plane with login code) rr set_cookie delete_cookier9rWrrrrr$r) rrredis_usage_cacher!redirect_responserr2 cache_value separatorr1s r_sso_return_to_redirectr s&$"9-,L$$ $B''(>?  33I>++B/(/ '0)L  (#33 Z\3] ] ]$44+[]4^ ^ ^"%"23 ')3i)]a@b6cc !!"bc,3O''(>?   ^ ^s%BD DD .D/AD D r`c|y t|xstj|}|r|j d|dddyy#t$rYywxYw)uBest-effort: persist a SAFE ``return_to`` on ``response`` as the one-shot ``litellm_cp_return_to`` cookie so ANY sign-in path — SSO / Okta / generic OR the username/password form — can resume there afterwards. THIS is the single source of truth, called by every sign-in branch so they cannot diverge (a per-branch reimplementation is exactly how the two drifted before). Honors a strictly relative same-origin path, and (when ``control_plane_url`` is configured) a return_to matching that origin. It NEVER raises: a mismatched or invalid ``return_to`` is simply not stored, so it can never block sign-in — the login entrypoint must always render.Nr9XTlax)rrmax_agehttponlysamesite)rr9rWrr)r`rsafes rrBrB sn1)<w@X@l@lmv@w &    s"A A  A ceZdZdZededefdZe dIdededzdedzd edzd edzd edzde dzfd Z e dJd e d edzdedzd edzde dzf dZ e dKd edzdedzde eeefedzffdZe dJdedzdedzd edzdefdZe dLd edededzdefdZedeezezdzdeezdzdedzdedzdef dZedeezezdzdeezdzfdZededeezezdzdedzdedfdZe dLd ed!edzfd"Ze dLd#eezd$ed ed!edzdef d%Ze dKd&edzd'edzdedzd(edzdedzf d)Z e dLdeezdzd edzde!fd*Z"e dMdeezezd ededzd edzd+edzd,edzd-e#dzdedzd.e$dzde fd/Z%ed ed0edefd1Z&ed edzd2ed3e'd4ed5e'd6e'ddfd7Z(ed2eddfd8Z)ede eeffd9Z*ed:d;defd<Z+ed=ed>ed?ed@edzdAedBedzdCededzdDeeefdefdEZ,edFedGedzdBedzdDeeefdef dHZ-y)Nr9zA Handler for SSO Authentication across all SSO providers rrcddlm}|jd}|ydtdtfd}||||k7r t dd y ) aN Validate that return_to matches the configured control_plane_url origin. Returns True if return_to is valid and should be used. Returns False if control_plane_url is not configured (return_to is ignored). Raises HTTPException(400) if return_to origin does not match control_plane_url origin. rrcontrol_plane_urlFrrct|}|jxsdj}|jxsdj}|dk(rdnd}|j |jn|}|||fS)NrhttpsiP)rschemerNhostnameport)rrErr default_portrs r_originz=SSOAuthenticationHandler._validate_return_to.._origin sh$SMF#]]0b779F%4";;=H)/7):#L)/)@&++lDHd+ +rr'z9return_to does not match the configured control_plane_urlrT)r rrrrr)rrrrs rrWz,SSOAuthenticationHandler._validate_return_to sc @#3#7#78K#L  $ , , , 9 ):!; ;R  rNr1r/r.r0r2rc4K|ddlm}tjdd}|+t dt j dtj||||}tjd|||5|j| d{cdddS|tjd d} tjd d} | +t d t j d tjt|| | |d } | 5| j| d{cdddS|ddl m} ddlm} tjdd}tjddj#d}tjdd}tjdd}tjdd}|+t dt j dtj|+t dt j dtj|+t dt j dtj|+t dt j dtjtj$d|||tj$d||| |||}| d| }||||d |!}t&j)||||"d{St+d#7\#1swYt+d#xYw7#1swYt+d#xYw7Aw)$a Step 1. Call Get Login Redirect for the SSO provider. Send the redirect response to `redirect_url` Args: redirect_url (str): The URL to redirect the user to after login google_client_id (Optional[str], optional): The Google Client ID. Defaults to None. microsoft_client_id (Optional[str], optional): The Microsoft Client ID. Defaults to None. generic_client_id (Optional[str], optional): The Generic Client ID. Defaults to None. request: Optional FastAPI request, used to drive the ``Secure`` attribute on the ``litellm_oauth_state`` CSRF cookie. Returns: RedirectResponse: The redirect response from the SSO provider. Nr GoogleSSOr1GOOGLE_CLIENT_SECRET not set. Set it in .env filer)rrrzLIn /google-login/key/generate, GOOGLE_REDIRECT_URI: %s GOOGLE_CLIENT_ID: %s)r2rr4MICROSOFT_CLIENT_SECRET not set. Set it in .env fileTrrtenantrrrrrnrorprqrrrsrtrvrwrxryrzr{rr)rrr)rr2rrzfUnknown SSO provider. Please setup SSO with client IDs https://docs.litellm.ai/docs/proxy/admin_ui_sso)fastapi_sso.sso.googlerrrrBrArrr|r$rget_login_redirectrSrrrrrArr9!get_generic_sso_redirect_responser/)r1r/r.r0r2rrr google_ssorr microsoft_ssorrr}r~rrrrrrs rrAz/SSOAuthenticationHandler.get_sso_login_redirect sc0  ' 8*,))4JD*Q #+$O(330>>  !**2)!J ! % %`    H':::GG H H! ,-/YY7PRV-W #&(ii0BD&I &.$R(333>>  $6-5')$( $M K*==E=JJ K K  * > ?+-995Ld+S !#%99_>T#U#[#[\_#`M46II>^`d4e *,.II6NPT,U "/1yy9TVZ/[ %$,$P(331>>  .5$Y(33:>>  &-$Q(332>>  )0$T(335>>  ! & &W.&)   ! & &C\Sd  1'E5"; I "1fQZ![K!,+3)$(# "K2SS'/M T   t  mH Hn t  EK KF t  shA0L2K'K$ K' A7LLK=LF7LLL$K''K:,L=LLLrrc Kddlm}m}m}m}ddlm}m} |5tj||\} } i} i} | jD]\}}|dvr|| |<|| |<|jdi| d{}| rUd| vrPd| d}||j|d | id d{n| j|d | id d{tjd | r|t|j d }||j"}| jD] \}}|g||< ||d}||j$|j&|j(|j*||j,f}||j d <| j/d}|r8|6|duxs|j0j$dk(}|j3d|d dd||cdddS7h7;7#1swYyxYww)z; Get the redirect response for Generic SSO r)rrr urlunparserr!)r2r)code_challengecode_challenge_methodNr2pkce_verifier:rrrz.PKCE code_verifier stored in cache (TTL: 600s)locationT)doseqrrr)rrrrrsecurer) urllib.parserrrrr rr!r9 _get_generic_sso_redirect_paramsrvrrr$rrrqueryrnetlocpathrrLrrr)rr2rrrrrrrr!redirect_paramsr pkce_paramsstate_only_paramsrrrr2 parsed_urlr new_querynew_url state_value secure_flags rrz:SSOAuthenticationHandler.get_generic_sso_redirect_response s KJT a %)II/MJ "$K') -335 3 UEE',K$-2%c*  3.L[-K-K-`N_-`'` O!;&4OG4L3M#N $0+;;%. >< -<<%. >= %**+[\(05F5N5Nz5Z1[(\J*2:3C3C*DL'2&7&7&94 U-2G S)4(1T'JI%/&--&--&OO&--%&//  &G=D%--j9&5%8%8%A #4#@*1D)YGKKO, -7=O3 4 & &'O P --rc|||yy)NTFr)r/r.r0s rr@z/SSOAuthenticationHandler.should_use_sso_handlerK s  '+>+JN_Nkrr)rcddlm}|t|j}|j dr||z }|S|d|zz }|S)z Get the redirect URL for SSO Note: existing_key is not added to the URL to avoid changing the callback URL. It should be passed via the state parameter instead. r)r^)rr)rr^rrendswith)rr)rr^r1s rr:z1SSOAuthenticationHandler.get_redirect_url_for_ssoU sU 7%s7;K;K7LM   % . .L C"44 4LrrXrrrrcbK |K|j}t|||}tt|j d|i|d{|St j dt||d{}|S727#t$r"}t jd||cYd}~Sd}~wwxYww)a Connects the SSO Users to the User Table in LiteLLM DB - If user on LiteLLM DB, update the user_email and user_role (if SSO provides valid role) with the SSO values - If user not on LiteLLM DB, insert the user into LiteLLM DB N)rXrrrrz.user not in DB, inserting user into LiteLLM DB)rrz,Error upserting SSO user into LiteLLM DB: %s) rrrrcrr$rrrr)rXrrrrrrrs rr z(SSOAuthenticationHandler.upsert_sso_userk s $!*!2!2%@!)#& $N=$ABNN$g.[O  %))*Z["1"((;#      * *+Y[\ ]  seB/AB A= BB/%B6A?7B<B/=B?B B, B'!B,"B/'B,,B/cK|tjdyt|dg}t||d{y7w)z Adds the user as a team member to the teams specified in the SSO responses `team_ids` field The `team_ids` field is populated by litellm after processing the SSO response Nz;User not found in LiteLLM DB, skipping team member additionr)rr)r$rrkr)rXrrs rr z   & &'d e "6:r: % YOOOs6A>ArrTcRtttzdz|jd}|yt |tryt |dg}|jddk(rI|jd}||vr4t d|d|d |tjdtj y) a when ui_access_mode.type == "restricted_sso_group": - result.team_ids should contain the restricted_sso_group - if not, raise a ProxyException - if so, return True - if result.team_ids is None, return False - if result.team_ids is an empty list, return False - if result.team_ids is a list, return True if the restricted_sso_group is in the list, otherwise return False Nr2Trrrestricted_sso_groupz)User is not in the restricted SSO group: z. User groups: z. Received SSO response: r) rr0rrrrkrBrArrr)rrXrr2rrs rrzrr r9._cast_and_deepcopy_litellm_default_team_paramsrWrrEr@rrr)rrrteam_objr!rs r"create_litellm_team_from_sso_groupz;SSOAuthenticationHandler.create_litellm_team_from_sso_group sN =   U$//%::   ! Q$3N=4Q$R$]$] /2%^%H ! & &'8( C$**+I?\mn+9',,L**7ff(/(C(C$3&7!- g  !$Ff+MN"0 ()<)E)E(FG#   -,  Q * *+La P P Qs_4E )D D!3DE A>DDDE DD E&E<E EE r r!cDt|tr"t|}||d<||d<tdi|}|Sttj t rOttj }|j}|j|tj|}|S)ac Casts and deepcopies the litellm.default_team_params to a NewTeamRequest object - Ensures we create a new DefaultTeamSSOParams object - Handle the case where litellm.default_team_params is a dict or a DefaultTeamSSOParams object - Adds the litellm_team_id and litellm_team_name to the DefaultTeamSSOParams object rrr) rr0rr>rr rhrrrh)r r!rr _team_request_default_team_params_new_team_requests rr(zGSSOAuthenticationHandler._cast_and_deepcopy_litellm_default_team_params s )4 0#+,?#@M'6M) $*;M, '):M:L  335I J*273N3N*O '3'>'>'@   $ $%9 :)889JKLrrrrc^ddlm}|tk(r|rt|r |d|d|S|d|Sy)a Checks the request 'source' if a cli state token was passed in This is used to authenticate through the CLI login flow. The state parameter format is: {PREFIX}:{login_id}[:{user_code}] - The state parameter is used to pass data through the OAuth flow without changing the callback URL - user_code is appended only for the opt-in verification_uri_complete flow so the verify page can pre-fill it rr,rN)r:r-r+r)rrrrr-s rr;z'SSOAuthenticationHandler._get_cli_state sI   2 2s*95:;1SE9+NN67q> >rc "tt|dd}| t|ddnd}d}|gtjdR|j dd}tjdj d}||vrt dd d |d |d i |Ct|dd}|4t |tr |jn|}tjd||j|htjdd}t|dd}tt|dd}|-t||d} | t | tr | jn| }|)|'t|ddxsd} t|ddxsd} | | z}||t|dk(r|}t|||S)ze Gets the user email and id from the OpenID result after validating the email domain rNr[ALLOWED_EMAIL_DOMAINS@rr?r+rzThe email domain=z!, is not an allowed email domain=z$. Contact your admin to change this.rrz'Extracted user_role from SSO result: %srrrSrrUr)rrr) rrkrrrArrr<rr$rrUrn) rXr0rrr email_domainallowed_domains _user_roler_role_from_attr _first_name _last_names rrz;SSOAuthenticationHandler._get_user_email_and_id_from_result7 s"1$1O!P =C=OgfdD9UY $  !bii0G&H&T","2"23"7":L%'YY/F%G%M%Mc%RO?2# #!%6|nDefuevw[$\   ' T BJ%0::GW0XJ,,^h $**+TV_`  (V-?68ii@]_e6f ,fdD1G($)GHJ )09Y[_)`".2iidd|d|d|d|d |d|ddd{}|d}|d}|d xst@jBjD}|r&tG|tHrtK|||d{}t!jLd||tO|xsi} | r&tQ|xsd}!|!stSddd|d |i!tG|tHr|rtU||"d{tW}"tYtI|jZd#$}#t]d%rVd}$|,|d't_|d|d xs|gt$j>&}$|$tSddd'i!tajb|$}|tetH||||xst@jBjDd(| | jd)d*|"tg+ }%dd,l4m5}&|&|%| xsd}'tm||'||-d{}(|(|(S|tG|tHr|#d.z }#t!j"d/|#to|#d01})|)jqd|'2|)S7777177o7iw)3Nr)rgenerate_key_helper_fnr0rrrr!r[r)ReturnedUITokenObjectrrrrrzSSO callback result: %sr\r]rr|)rJrrrr!r)rrzUnable to map user identity to known values. 'user_defined_values' is None. File an issue - https://github.com/BerriAI/litellm/issuesz+user_defined_values for creating ui key: %srzlitellm-dashboardrr^r_) request_typedurationkey_max_budgetaliasesconfigspendrrrrrr^r_ table_namer)rrrz!user_role: %s; ui_access_mode: %srr+rz,User not allowed to access proxy. User role=z , proxy mode=rr}zui/rEXPERIMENTAL_UI_LOGIN)rrrr^z6User Information is required for experimental UI loginssolitellm_key_header_name Authorization) rrrr login_methodrauth_header_name(disabled_non_admin_personal_key_creationserver_root_path)encode_ui_session_jwt)rrrr!z?login=successr7rrr)9r rr:r0rrrr!r[rrlitellm.types.proxy.ui_ssor;r9rrr$rrrbrcr`rar/rCrrr r$rr,max_ui_session_budgetr<r"rrrr(rrUrVrr9rr^rrdr;rF(get_experimental_ui_login_jwt_auth_tokenrr_litellm.proxy.auth.login_utilsrKrrr)*rXrrr0r2rrJrrrr:r0rrrr!r[rr;rrYrrrruser_id_modelsrbrcrrdr`ris_admin_only_access has_accessrIlitellm_dashboard_ui _user_inforeturned_ui_token_objectrKrreturn_to_redirectrs* rrCz:SSOAuthenticationHandler.get_redirect_response_from_openidq s  CD9:st '?&a&a->'b' 144\B &**95(,,[9 !!";VD &(*1*J*J /6/T/T%<@;J  )**+=>,>v,F&F# !OPP  "6%%3# = #  !DD-/ E 0'1/! 3%  0#2G6G'1 3    P5H   &X  !!"OQde 60"88'&x0' 2*<8)+6*<8/0AB!  "w9%' 4f8H8`8`8f8f z'3/@#WMI ""#F Sab&@AUSU&V  3IO DJ# ##OPY{Zghvgw!x gs #7S`a a a:f:h0-s7CSCS?T\ab 2 337J".3Fy3Q3]./ :1+>K)&<<  !# ##%]^ )QQR\]C*?g&!Q#3#K#K#Q#Q%-112K_]5]13 +   I01I:K[Y[\ +B/1 + %   )% %  :gs#; $4 4 !!"57KL#38LZ]#^$$ $B  m'G(  ( ,$ bR% sCO1OAO1&O 'O1O#A1O15O&6AO1O) A4O1=O,>DO1O/AO1 O1#O1&O1)O1,O1/O1rc&Kd|i}t|j}|jd}tjddj dk(}|r|st jd|r|rddlm }m }d |}||j| d {} n|j| d {} d } d } | rt| tr:d | vr6| d } | sd} t jd|ngt jdnQt| tr| } t jdn)t jdt| j | r | |d <||d<|St"j%||| | ||d {|S777 w)z Prepare token exchange parameters for Generic SSO. Args: request: Request object generic_include_client_id: Generic OAuth Client ID Returns: dict: Token exchange parameters rr2rr4r5u=PKCE is enabled (GENERIC_CLIENT_USE_PKCE=true) but no 'state' parameter was found in the callback. The PKCE verifier cannot be retrieved without a state value — the token exchange will proceed without code_verifier, which the provider may reject. Ensure your OAuth provider returns 'state' in the callback redirect.rrrNr(FrTuPKCE verifier dict for state '%s' has an empty/null code_verifier value — may indicate a storage bug. Treating as a cache miss.z'PKCE code_verifier retrieved from cachez[Retrieved code_verifier in legacy plain-string format. Future storage will use dict format.z:Unexpected PKCE verifier cache format (type=%s); skipping.r)r2r2 cached_dataempty_value_in_dictrr!)r0rrrrrNr$r1r rr!async_get_cacherrrrrr9_handle_missing_pkce_verifier) rr token_paramsrr2rrr!r2rXr_empty_value_in_dicts rrz:SSOAuthenticationHandler.prepare_token_exchange_parameters:s 3FG`1a #7#7#78 #''0))$=wGMMOSYY E ( (,  X X!/w7I ,$5$E$E)$E$TT $6$F$F9$F$UU  M#( k40_ 5S$/$@M(04,,44^! -223\] S1$/M(00u)..T[)22 0= _-3< .//LL' +(<&7'9 MoUUZs7BFF F2F 3CFFF FFr2rXrYrr!cK||n|}tjddjdk(}|r?|rLtj |d{t d|dt jdtj|tj |d{tjd |t|jt d|d t|jd t jdtj|d }nd }tjd||t|jt d|d|t jdtj|tj |d{tjd|t|j|duy7r7'78w)zHandle the case where PKCE verifier could not be extracted from cache. In strict mode (PKCE_STRICT_CACHE_MISS=true) raises ProxyException. Otherwise logs a warning and returns (token exchange proceeds without verifier). NPKCE_STRICT_CACHE_MISSr4r5zPKCE verifier for state 'u[' was found in cache but has an empty or null code_verifier value — possible storage bug.PKCE_CACHE_MISSruPKCE verifier for state '%s' has an unrecognized format (type=%s); treating as a cache miss. Investigate the cached value — it may be a corrupt or stale entry.z#' has an unrecognized format (type=z#). The cached entry may be corrupt.uThe authorization and callback were likely handled by different instances — the verifier was stored on one pod but not found on another.zThe verifier may have expired (TTL), been lost on a pod restart, or the PKCE authorization step was never completed. Configure Redis so all proxy instances share the PKCE verifier.zQPKCE is enabled but no verifier found in cache for state '%s'. %s Cache type: %s.z,PKCE verifier not found in cache for state 'z'. uPKCE is enabled but verifier not found in cache for state '%s' (cache type: %s, raw data present: %s). Continuing without code_verifier — set PKCE_STRICT_CACHE_MISS=true to fail fast instead.)rrrNr9rrBrArrrr$rrrr1) r2r2rXrYrr! active_cachestrict_cache_misscauses rr[z6SSOAuthenticationHandler._handle_missing_pkce_verifiers4E3P/Vh #%99-Ew#O#U#U#W[a#a ".DDYOOO$3E7;]^)33+55(.DDYOOO$**0%.. %3E7;!!%k!2!;!; <<_a)33+55%0e Z %**g&//  %J5'QTUZT[\(33+55 &.DDYOOO ( (m\"++4'  oPPVPs8A G F?A GGC0G G 3GGGcKddlm}m} ||j|d{y|j|d{y7 7#t$r!}t j d||Yd}~yd}~wwxYww)zDelete a single-use PKCE verifier from cache after a successful exchange. Failure is non-fatal: a leftover verifier is a minor security concern (unused key in cache) but not worth aborting an otherwise-successful login. rrNr(zHPKCE: failed to delete verifier cache key '%s' (best-effort cleanup): %s)r rr!async_delete_cacherr$r1)r2rr!excs rrz.SSOAuthenticationHandler._delete_pkce_verifiersz U  ,'::y:III(;; ;JJJJJ  ( (Z   sX A5AAAA5AAAA5AA A2A-(A5-A22A5c`tjtjdj dj d}t j|jdj}tj|j dj d}||fS)a Generate PKCE (Proof Key for Code Exchange) parameters for OAuth 2.0. Returns: Tuple[str, str]: (code_verifier, code_challenge) - code_verifier: Random 43-128 character string (we use 43 for efficiency) - code_challenge: Base64-URL-encoded SHA256 hash of the code_verifier Reference: https://datatracker.ietf.org/doc/html/rfc7636 rrr) base64urlsafe_b64encoder token_bytesrrstriprrrdigest)rcode_challenge_bytesrs rrz-SSOAuthenticationHandler.generate_pkce_paramss &778K8KB8OPWWX_`gghkl '.nn]5I5I'5R&S&Z&Z&\ & 8 89M N U UV] ^ e efi jn,,rr`zhttpx.Responsec t|j}t|tsytjdt|j|j ddt dt|jd tjdtj|}|jd }t|t r|s|jd }|jd d }|r |r|d|n|}ndt#|j%d }tjd|t d|tjdtj|S#t$rW}tjd||j ddt d|tjdtjd}~wwxYw)z Parse and validate the token endpoint response. Ensures the response is valid JSON, a dict, and contains a non-null access_token string. Raises ProxyException on any validation failure. z4Failed to parse token response as JSON: %s. Body: %sNr1z&Token endpoint returned invalid JSON: token_exchangerz9Token endpoint returned non-dict JSON (type=%s). Body: %szNToken endpoint returned unexpected response format (expected JSON object, got )rrrr*r - zEtoken endpoint returned HTTP 200 but no access_token (response keys: z6Token response missing or null access_token. detail=%sToken exchange failed: )rr-rr$rtextrBrArrrrr0rrrrsortedr)r`token_response_rawjson_errtoken_responseaccess_token_valr error_descr!s r_validate_token_responsez1SSOAuthenticationHandler._validate_token_responses 0:8==?0K ,d3 & &K'(11 ds#  !2267I2J2S2S1TTUW%//&11 '9"0"4"4^"D*C08H)--g6E . 2 23F KJ6@E7#j\2e''-n.A.A.C'D&EQH ! & &'_ag h 1&:$//&11  c  & &F ds#  !@ K$//&11   sE F=&AF88F=rrrrrrrrc Ktjdt|d||d} |r|| d<i|ddd} |sG|r?tj|d|j j } d | | d <n|| d <n || d <|r|| d <ttj } | j|| | dd{} | j$dk7rvtjd| j$| j&ddtd| j$d| j&ddtjdt j"t(j+| }tjdt-|j/dt(j1|d|j/d||d{}i||}t2D]3}|j/| ||||<||vs"|j5|d5|S7D#t$rJ}tjd|td|tjdt j"|d}~wwxYw7w)au Performs a direct OAuth token exchange including the PKCE code_verifier. fastapi-sso does not forward code_verifier, so when PKCE is enabled we bypass it and call the token endpoint ourselves, then fetch user info. Returns a combined dict of the token response and user info, suitable for passing to a response_convertor. z@PKCE: performing direct token exchange (code_verifier length=%d)r) grant_typerrrz!application/x-www-form-urlencodedapplication/json) Content-TypeAcceptrzBasic rFrr llm_providerg>@)rr]rtimeoutNz#PKCE token endpoint unreachable: %szToken endpoint request failed: rorrz-PKCE token exchange failed. status=%s body=%sr1rrrqz3PKCE token exchange successful. id_token_present=%srqrr)rrrqrr)r$rrUrh b64encoderrr5r6 SSO_HANDLERpostrrrBrArrrr rsr9rzrr_get_pkce_userinfortru)rrrrrrrr1r token_datarequest_headers credentials http_clientr`rfrwrmergedfields rrz-SSOAuthenticationHandler._pkce_token_exchangeUs* "" N   /&*-  )5J~ &"  " ?("  !%+%5%5 1]O6T6[6[6]%^%e%e%g 5;K=3I0*3 ;'&/J{ #.; ?+3AUAaAab  $/$4$4"' %5%H"   3 & & &?$$ ds#  !1(2F2F1Gs8==Y]Z]K^J_`$//&11  !9 Q QRZ ["" A ##J/ 0 !9 K K'7#'' 3/1 !L!  ,7>6X6( (E!!%(4 .u 5u .( 5$'  ( K   ! & &'Lc R 9#?$//&11     @ sPB%I(HHHC6I;I<1I.IH IAIIIrrrqc>Kd}|r ttj}|j|i|dd|id{}|jdk(rB |j }|s,t jdt|jd}n|}n.t jd |j|jdd |Et|tr5|r3 tj|d d i}|st jdd}|]t|txr t-|} |r| rd} n d} n| rd} nd} t#d| dt$j&dt(j*|S7,#t$r }t jd|Yd}~d}~wwxYw#t$r } t jd | Yd} ~ d} ~ wwxYw#t$rI} t j d| t#d| t$j&dt(j*d} ~ wwxYww)z Fetches user info from the userinfo endpoint. Falls back to decoding the id_token if the endpoint is unavailable. NrrFBearer )rrrzUserinfo endpoint returned an empty or null response (type=%s); treating as failure and attempting id_token fallback. Check your provider's userinfo endpoint configuration.z=Userinfo endpoint returned non-JSON response (status 200): %szBUserinfo endpoint returned %s (body: %s), falling back to id_tokenr1z5Userinfo endpoint error: %s, falling back to id_tokenrFru=id_token decoded to an empty payload — treating as failure.zFailed to decode id_token: %szFailed to decode id_token JWT: rruruserinfo endpoint failed and id_token was present but decoded to an empty payload — no identity claims availablezJuserinfo endpoint failed and no id_token was present in the token responseuno userinfo endpoint is configured (GENERIC_USERINFO_ENDPOINT) and id_token decoded to an empty payload — no identity claims availablezZno userinfo endpoint is configured (GENERIC_USERINFO_ENDPOINT) and no id_token was presentzSSO user info unavailable: rS)r5r6rrr r-r$r1rrrrsrrrrrrBrArrrr) rrrqrrrclientresp userinfo_rawrvr decode_errid_token_attemptedr!s rrz+SSOAuthenticationHandler._get_pkce_userinfosS!% $ i 6DXDdDd e$*JJ),'7<.)A%/%##s*.2iik +188!Y!%\ 2 ; ;  (,H'3H)00\(( $3   8S 9h ::h9KU8ST)001pq#H  (28S(A(Td8n  %W jF%d u!5fXQ?$// 11  m,%,44[$ i$,,-dfghh i" $**+JJW$=j\J(33$55  sH9FE-FAE0/FH2G A!H-F0 F9FFFF G%G;HGH HAHHHNNNNNNNN)NNr)NNNNNNN).rrrr staticmethodrrrWrrrAr rrr0rr@r:rYror@r;rCr\r r r rr*rhr>r(r;rnrrKr7rCrrr[rrrzrrrrrr9r9 sst<(,*.(, "& E E *E !4ZE : E Tz E 4 E  D E E N!59"& n%n%Tzn%),d n%4 n% D n%n%` 592.Tz2.(+d 2. tCH~sTz) *2.2.h'+*.(,* 4Z:  $(Dj *#v%,t3#"%66=#$J#2D8 # $ ##JPv%,t3P"%66=PP !!v%,t3! $;!  !!F)-9Q9Q:9Q9Qv )- 1D8$:   2$( $ d  4ZDj:  t 4)-7  $7 :7  7 7 r*.(,&*,0)- $59F! ,F!F! $;F!: F! t F! #Tk F! $&F!:F!,d2F! F!F!P^^#'^ ^^@OTzOOO" O " O # O OObst(-%S/--*:+;:::x||||Tz |  | : | |Dj|!cN| |||gg*g:g!cN g  ggrr9c eZdZdZdZ dZdZedefdZ edefdZ e d"de d ed ed e de ezezf d Zed edzdeededzde fdZedeedzdedzfdZededzdeefdZe d#dedzdeefdZededededeeeedzffdZed edeefdZed edefdZe d#dedededzdeeeeeffdZed eefd!Z y)$r@zS Handles Microsoft SSO callback response and returns a CustomOpenID object z https://graph.microsoft.com/v1.0rgraph_api_user_groupsrc<tdxstjS)z Returns the Microsoft Graph API base URL, configurable via the `MICROSOFT_GRAPH_ENDPOINT` env var so non-default clouds such as Azure Government (GCC High) can point at `https://graph.microsoft.us/v1.0` MICROSOFT_GRAPH_ENDPOINT)rer@DEFAULT_GRAPH_API_BASE_URLrrrget_graph_api_base_urlz*MicrosoftSSOHandler.get_graph_api_base_urlNs89k=P=k=kkrc0tjdS)Nz /me/memberOf)r@rrrr"get_graph_api_user_groups_endpointz6MicrosoftSSOHandler.get_graph_api_user_groups_endpointWs%<<>?|LLrrr.r1return_raw_sso_responsecKtjdd}tjdd}|+tdtjdt j |+tdtjdt j t||||d}|j|d d{xsi}tj|j d{}tj|j } tjd | tj!| } tjd||r||tj"<| |d<|xsiStj%||| } | S77w)z Get the Microsoft SSO callback response Args: return_raw_sso_response: If True, return the raw SSO response rNrrrz-MICROSOFT_TENANT not set. Set it in .env fileTrFrconvert_response)rr)rqz%Extracted app roles from id_token: %sz*Combined team_ids (groups + app roles): %s app_roles)r`rr)rrrBrArrr|rSrr@get_user_groups_from_graph_apirrget_app_roles_from_id_tokenrqr$rget_user_role_from_app_rolesGRAPH_API_RESPONSE_KEYopenid_from_response) rr.r1rrrroriginal_msft_result user_team_idsrrrXs rrAz3MicrosoftSSOHandler.get_microsoft_callback_response[s*,3Ld)S"$)),>"E " * N$///::    # G$//(::   2)1#% $   22!&3   &9%W%W&33&X&  /JJTaTjTjJk ""#JIV/KKIV ""#OQ^_ #O\ !4!K!K L09  -'-2 -+@@)"A   ?  s%B-E?/E;0+E?E=B E?=E?r`Nrrc |xsi}tjd|tt|j t xs|j d|j t d|j t|j t|j t||}tjd||S)Nz#Microsoft SSO Callback Response: %smailr)rr\rWr[rSrUrrz!Microsoft SSO OpenID Response: %s) r$rrYrrr/r.r1r0r2)r`rropenid_responses rrz(MicrosoftSSOHandler.openid_from_responses >r""#H(S!-!(,,/M"N"fRZR^R^_eRfg!&KL ||78||$GHll#EF "  ""#FXrrctdd|xsdDDsytfdtDd}||StdS)a Resolve the one role LiteLLM stores for a user from their Entra app roles. Entra does not guarantee `roles` claim ordering, so a user holding several app roles resolves to the highest privilege one rather than whichever the claim listed first. Roles the hierarchy does not rank (org_admin, team, customer) resolve by name to stay deterministic c3&K|] }|| ywrr)rrs rrzCMicrosoftSSOHandler.get_user_role_from_app_roles..s$ bfbrD$ sc32K|]}t|ywr)rZ)rrole_strs rrzCMicrosoftSSOHandler.get_user_role_from_app_roles..s^(3H=^srNc3,K|] }|vs| ywrr)rrresolveds rrzCMicrosoftSSOHandler.get_user_role_from_app_roles..s_tdV^N^d_s c|jSrr)rs rzBMicrosoftSSOHandler.get_user_role_from_app_roles..s PTPZPZrr()r r rmin)rrankedrs @rrz0MicrosoftSSOHandler.get_user_role_from_app_rolessZ$$ ^io[]^$  _/J_aef+v[XCZ1[[rrqc|stjdgS ddl}|j|ddi}|j dgxs|j dg}|r2t |t r"tjd t|||Stjd gS#t$r"}tjd |gcYd}~Sd}~wwxYw) a Extract app roles from the Microsoft Entra ID (Azure AD) id_token JWT. App roles are assigned in the Azure AD Enterprise Application and appear in the 'app_roles' claim of the id_token. Args: id_token (Optional[str]): The JWT id_token from Microsoft SSO Returns: List[str]: List of app role names assigned to the user z,No id_token provided for app role extractionrNrFrrrz$Found %s app role(s) in id_token: %sz;No app roles found in id_token or roles claim is not a listz,Error extracting app roles from id_token: %s) r$rrrrrrrUrr)rqr decoded_tokenrrs rrz/MicrosoftSSOHandler.get_app_roles_from_id_tokens & &'U VI  $.3::hASUZ@[#\M),,["=_ARARSZ\^A_EE40$**+QSVW\S]_de $**+hi   & &'UWX YI s$A3B&B&& C/C C CrrczK ttj}tjdd}g}g}|ret j |||d{\}}tjd|t|dkDrt j|d{g}t j}dd |i}d}|b|t jkrOt j||| d{\} }|j| |d z }||t jkrO|7|t jk\r$tjd t j|r"t|dkDr|D cgc] } | |vs|  }} |S7,77cc} w#t $r"} tj"d | gcYd} ~ Sd} ~ wwxYww)a Returns a list of `team_ids` the user belongs to from the Microsoft Graph API Args: access_token (Optional[str]): Microsoft Graph API access token Returns: List[str]: List of group IDs the user belongs to rMICROSOFT_SERVICE_PRINCIPAL_IDN)service_principal_id async_clientrrzService principal group IDs: %sr)service_principal_teamsrFr)rrrrzBReached maximum page limit of %s. Some groups may not be included.z6Error getting user groups from Microsoft Graph API: %s)r5r6rrrr@$get_group_ids_from_service_principalr$rrU4create_litellm_teams_from_service_principal_team_idsrMAX_GRAPH_API_PAGESfetch_and_parse_groupsr^r1rr) rrrrservice_principal_group_idsr all_group_ids next_link auth_headers page_count group_idsgroup_idrs rrz2MicrosoftSSOHandler.get_user_groups_from_graph_apis1 "8FZFfFf"gL+-))4TVZ*[ <> 'RT ##.RR)=!-!-S/+ %**+LNij23a7-bb0Gc M$7$Z$Z$\I#2gl^4L"MLJ'J9L9`9`,`-@-W-W!>> G os!A9A5-A9A7.A97A9cg}|jdgxsgD]'}|jd}||j|)|S)Nrr[)rrC)r`r_object _group_ids rrz:MicrosoftSSOHandler._get_group_ids_from_graph_api_response>sR ||GR06B ,G D)I$  + ,rc Kg}|jdgD]|}|jt|jd|jd|jd|jd|jd|jd~t|jd |jd | Sw) Nrz @odata.typer[deletedDateTime description displayNameroleTemplateId) odata_typer[rrrrz@odata.contextr) odata_contextrr)rrCrirj)r`directory_objectsrs rrz1MicrosoftSSOHandler._cast_graph_api_response_dictIsUW||GR0 G  $ $9&{{=9{{4($+KK0A$B ' M : ' M :#*;;/?#@   2",,'78#<<(9:#  sCCrc Ktj}d|d}||z}d|dd}g}g}d} || tjkr|j||d{} | j } t j d | | jd gD]q} | jd d k(s|j| jd |jt| jd| jd s| jd}| dz } || tjkr|7| tjk\r$t jdtj||fS7w)z Gets the groups belonging to the Service Principal Application Service Principal Id is an `Enterprise Application` in Azure AD Users use Enterprise Applications to manage Groups and Users on Microsoft Entra ID z/servicePrincipals/z/appRoleAssignedTorr})rFr~rNrz8Response from service principal app role assigned to: %sr principalTypeGroup principalIdprincipalDisplayName)rrrrz_Reached maximum page limit of %s. Some service principal group assignments may not be included.) r@rrrr-r$rrCrkr1) rrrrrendpointrrrrrr`rrs rrz8MicrosoftSSOHandler.get_group_ids_from_service_principal_s.DDF/0D/EEWX (8 3  '|n5.  ') NP # 5H5\5\(\)--i-IIH3;==?M & &'acp q(,,Wb9 ;;/7:$$W[[%?@+22518=S1T(/ M(B &))*;E9rcKtjd||D]\}|jd}|jd}|stjd|>tj ||d{^y7w)z Creates Litellm Teams from the Service Principal Group IDs When a user sets a `SERVICE_PRINCIPAL_ID` in the env, litellm will fetch groups under that service principal and create Litellm Teams from them z7Creating Litellm Teams from Service Principal Teams: %srrz;Skipping team creation for %s because it has no principalId)rrN)r$rrr9r*)rservice_principal_teamrrs rrzHMicrosoftSSOHandler.create_litellm_teams_from_service_principal_team_idss ""#\^uv&=  "*@*D*D]*SO,B,F,FG],^ "$**QSd*MM /"3N    sA1A=3A;4A=Fr)!rrrrrrrrrrrrrrYror0rArr<rrrrrr4rrrjrrrkrrrrrr@r@?s"D5lCllMMM ). CC CC"& C   % CCJ+s)$d*  (\C=4'\ D \\(%cDj%T#Y%%N#'=Dj= c==~? ??/?? tCy#*$ %??4 c  +  *$(42!42&42Dj42 tCy$<== > 4242l!%&C!Drr@c @eZdZdZe d dededededee zf dZ y) r>zP Handles Google SSO callback response and returns a CustomOpenID object rr/r1rrc:Kddlm}tjdd}|+t dt j dtj||||}|r|j|d d{xsiS|j|d{}|xsiS7'7 w) z Get the Google SSO callback response Args: return_raw_sso_response: If True, return the raw SSO response rrrNrr)rrrFr) rrrrrBrArrr|r)rr/r1rrrrrXs rr?z-GoogleSSOHandler.get_google_callback_responses 5&(ii0F&M  ' K$//,::   &&%.  # 33#%*4  );;GDD|Es$A-B/B0B B BBNr) rrrrrrrrror0r?rrrr>r>sR ). ''''"& ' $ ''rr>z/sso/debug/logincKddlm}tjdd}tjdd}tjdd}|||/|dur+t dt j d tj tj|d }tj||| dur"tj|||||d{Sy7w)r r)rr#Nr$r%TaaYou must be a LiteLLM Enterprise user to use SSO. If you have a license please set `LITELLM_LICENSE` in your env. If you want to obtain a license meet with us here: https://enterprise.litellm.ai/demo You are seeing this error message because You set one of `MICROSOFT_CLIENT_ID`, `GOOGLE_CLIENT_ID`, or `GENERIC_CLIENT_ID` in your env. Please unset thisrrsso/debug/callbackr(r-)r1r.r/r0r) r rrrrBrArrrr9r:r@rA)rrr.r/r0r1s rdebug_sso_loginrs8!#+@$!G ii(:DA!yy)t@fs||||<C t%|||<S|xsij9Dcic]\}}|tDvs||}}}|xsij9Dcic]\}}|tDvs||}}}|||d}|jF|dt$jIdd }tKjHd!d"|d#}||$S77p7X#tB$r}d|||<Yd}~&d}~wwxYwcc}}wcc}}ww)%z@ Returns the OpenID object returned by the SSO provider rNrr.rJ)rrJrr!r2r3r4r5r#r$r%rrrrT)rr/r1r)rr.r1rr8zT

SSO Authentication Failed

No data was returned from the SSO provider.

r'r__dict__rz!Complex value (not displayable): )parsed_by_proxy raw_claimsaccess_token_claimsrT)indentrzr?r@rArrZrrvr*rwrxrrrtr7rbrO)rr-rr/rKrrJrr!rr2r.r/r0r1rXrr_sso_assertionrmfiltered_resultrrrkvsafe_raw_claimssafe_access_token_claims sso_payloadsso_payload_jsonrs rdebug_sso_callbackrs` .48*.O,001A4HN!j&F$,**'1+#3#7#78H"#M#Q#QRgim#n + "$+@$!G ii(:DA!yy)!S-Nqc+ROC(S rvsD7K>9K :#K>K K>8K9AK> K>(K>KK>/K2K2K>K80K85AK> K>K> K/K*$K>*K//K>rrrr(rrrhrr`r-rrercollections.abcrrcopyrhtmlrtypesrtypingr r r r r rrrrrrrrrrhttpxrfastapirrrrrrrrrpydanticrr r!r"r#rlitellm._loggingr$ litellm._uuidr%litellm.caching.dual_cacher&r:r'r(r)r*r+r,r-r.r/r0r1r20litellm.litellm_core_utils.dot_notation_indexingr3&litellm.llms.custom_httpx.http_handlerr4r5r6Olitellm.proxy._experimental.mcp_server.outbound_credentials.sso_assertion_storer7r8r9r;r:r;r<r=r>r?r@rArBrCrDrErrFrGlitellm.proxy.auth.auth_utilsrHrIr<rK$litellm.proxy.auth.user_api_key_authrL)litellm.proxy.common_utils.admin_ui_utilsrMrN:litellm.proxy.common_utils.html_forms.jwt_display_templaterO.litellm.proxy.common_utils.html_forms.ui_loginrP-litellm.proxy.common_utils.user_api_key_cacherQ:litellm.proxy.management_endpoints.internal_user_endpointsrR&litellm.proxy.management_endpoints.ssorS/litellm.proxy.management_endpoints.sso.saml_ssorT3litellm.proxy.management_endpoints.sso_helper_utilsrUrV1litellm.proxy.management_endpoints.team_endpointsrWrX(litellm.proxy.management_endpoints.typesrYrZr[rr\r]r^r_%litellm.repositories.prisma_protocolsr`'litellm.repositories.table_repositoriesra$litellm.repositories.team_repositoryrb$litellm.repositories.user_repositoryrclitellm.secret_managers.mainrdrerfrrhrirjrkrlrmrLrnrrorprr rtrurvrxrzr|compiler}rrrwrxrr~rrrrrrrrr0rrrrrrrrrrrrrrrrrrrrr rrr%r4r8r=rrIrPrWr\rhrnrsr~rrrrrrrrrrPROXY_ADMIN_VIEW_ONLYrr"rrrrrrrrIrlrrrrrrrrrrrrrrr r$r(rIrLrPrXrerkrrrvrzrrBrrrrrrrBr9r@r>rrrrrrs  -"    76 XXX.YY10    N     S5BOIOEKX  ?G??UU=:+$  ''TUUU+K*LE(RR7U6VVg4h*Eh24(%402&2%GUG(bjj)GHeH" b)D(EXNiMjjq#rs #S%6u6(bjj)=>e>'0  (u ;x; +K ?H? ,1N 6X6.-K!,DcN ;;#.wsF{/C#D5DFf9f >>CCCCC.S. :#:#:XtXX[3:[$[XDX   #Tz   #sSy. .LWLSWZ^S^LknL(-      (&t&I&$&RTTITTTdTXdXtXX$uS#X"76VVVv$ v 5S&[8I IdSVX^S^N_'#v+"6CF. <\F%:T#v+=N%N <\_ 2BV[\#?G#?s#?]#?L>3:>#*>,  **"",, &U+&c+&!+&+&d/3 `Dj`$&` TMD `N+ `  D[ `F $C$J $73;3G $ c6k" Dj *  S&[  d S_bfSf ko * ~&6%P#  C C $JC tC* C Tz C Tz CQCR*..2.2 uu $&uN+ u N+ u  up88*-8 3S 3S$ ./8v!H^$<!H7H^$<7t DcN 4 4 $'$J4  $J4  4  4 nEP EPEP $&EP EP  EP   TM4$;t -AD-HH EPP _ __?P-P_]abe]f_$5 4Zd  (  $   @%)= 6 !D (==(=$ = d = .4 =Tz=(4/=@ t   .&$. /$ 6d 4Z #v+ @, d", d{, !?2T9,  , ( , .4 ,  , ^ ?2T9-4D BcZfimZm*O>"2eL}}t}M}@ ^$4Nxgx#*xOx '75QDDRD !(8ER22S2j TM,D 073;#7