scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-23 00:41:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 81

fix(sso): include Okta in startup PKCE-no-redis warning; fall back to GENERIC_SSO_HEADERS for Okta

Browse source 
Co-authored-by: Yassin Kortam <yassin@berri.ai>
This commit is contained in:
Cursor Agent 2026-05-15 13:24:59 +00:00
parent 3454b00c28
commit 1e59ac00bd
No known key found for this signature in database
2 changed files with 19 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
litellm/proxy/management_endpoints/ui_sso.py
View file

@ -1080,7 +1080,10 @@ def _parse_generic_sso_headers(
provider: _OIDC_PROVIDER_NAMES = _OIDC_PROVIDER_GENERIC,
) -> dict:
"""Parse comma-separated *_SSO_HEADERS env var into a dict."""
raw = os.getenv(f"{_get_oidc_env_prefix(provider)}_SSO_HEADERS", None)
raw = os.getenv(
f"{_get_oidc_env_prefix(provider)}_SSO_HEADERS",
os.getenv("GENERIC_SSO_HEADERS", None),
)
if raw is None:
return {}
result: Dict[str, str] = {}

17
litellm/proxy/proxy_server.py
View file

@ -4008,13 +4008,26 @@ class ProxyConfig:
### PKCE MULTI-INSTANCE PREREQUISITE CHECK ###
# PKCE verifiers are stored in redis_usage_cache when available so they can
# be read back by any instance (not just the one that started the auth flow).
use_pkce = os.getenv("GENERIC_CLIENT_USE_PKCE", "false").lower() == "true"
generic_use_pkce = (
os.getenv("GENERIC_CLIENT_USE_PKCE", "false").lower() == "true"
)
# Okta defaults PKCE to enabled when OKTA_CLIENT_ID is configured.
okta_use_pkce = (
os.getenv("OKTA_CLIENT_ID") is not None
and os.getenv("OKTA_CLIENT_USE_PKCE", "true").lower() == "true"
)
use_pkce = generic_use_pkce or okta_use_pkce
if use_pkce and redis_usage_cache is None:
global _pkce_no_redis_warning_emitted
if not _pkce_no_redis_warning_emitted:
_pkce_no_redis_warning_emitted = True
pkce_env_var = (
"GENERIC_CLIENT_USE_PKCE=true"
if generic_use_pkce
else "OKTA_CLIENT_USE_PKCE defaults to true when OKTA_CLIENT_ID is set"
)
verbose_proxy_logger.warning(
"GENERIC_CLIENT_USE_PKCE=true but Redis is not configured for LiteLLM caching. "
f"{pkce_env_var} but Redis is not configured for LiteLLM caching. "
"PKCE verifiers will not be shared across instances — callbacks may land on a "
"different pod than the login request and fail silently. "
"Configure Redis via the 'cache' section in your proxy config, "