scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-25 01:02:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 81

fix(jwt): include issuer-normalized team id in get_all_jwt_team_ids

Browse source 
The aggregator for team IDs only consulted the issuer-normalized claim
for the plural (team_ids) path and fell back to the global config for
the singular path. When an operator configures team_id_jwt_field only
at the issuer level, get_team_id correctly returned the mapped value
but get_all_jwt_team_ids silently dropped it, causing membership
reconciliation to disagree with request routing.

Co-authored-by: Yassin Kortam <yassin@berri.ai>
This commit is contained in:
Cursor Agent 2026-05-21 18:47:51 +00:00
parent 457b21f213
commit 4ddbb91825
No known key found for this signature in database
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
litellm/proxy/auth/handle_jwt.py
View file

@ -284,12 +284,18 @@ class JWTHandler:
default-team behavior should still go through ``get_team_id``.
"""
team_ids: List[str] = list(self.get_team_ids_from_jwt(token))
if self.litellm_jwtauth.team_id_jwt_field is not None:
singular: Any = None
if self._has_trusted_issuer_normalized_claim(
token=token, claim=self.LITELLM_TEAM_ID_CLAIM
):
singular = token.get(self.LITELLM_TEAM_ID_CLAIM)
elif self.litellm_jwtauth.team_id_jwt_field is not None:
singular = get_nested_value(
data=token,
key_path=self.litellm_jwtauth.team_id_jwt_field,
default=None,
)
if singular is not None:
if isinstance(singular, list):
for item in singular:
if item is None: