fix(sso): address Greptile findings on Okta OIDC PR

- ui_sso.debug_sso_callback: Okta branch now captures received_response
  and access_token_payload from get_generic_sso_response so the debug
  page surfaces raw_claims and access_token_claims (matches generic
  branch behavior).
- ui_crud_endpoints.update_sso_settings: redact secret fields in the
  PATCH 200 response body so plaintext secrets (including those restored
  from the **redacted** sentinel) never leak back to the caller. GET was
  already redacted; PATCH now matches.
- Update test_update_sso_settings to expect redacted secrets in the
  response.

litellm/proxy/management_endpoints/ui_sso.py

@@ -4228,13 +4228,15 @@ async def debug_sso_callback(request: Request):
         )
 
     elif okta_client_id is not None:
-        result, _, _ = await get_generic_sso_response(
-            request=request,
-            jwt_handler=jwt_handler,
-            generic_client_id=okta_client_id,
-            redirect_url=redirect_url,
-            sso_jwt_handler=sso_jwt_handler,
-            provider=_OIDC_PROVIDER_OKTA,
+        result, received_response, access_token_payload = (
+            await get_generic_sso_response(
+                request=request,
+                jwt_handler=jwt_handler,
+                generic_client_id=okta_client_id,
+                redirect_url=redirect_url,
+                sso_jwt_handler=sso_jwt_handler,
+                provider=_OIDC_PROVIDER_OKTA,
+            )
         )
 
     elif generic_client_id is not None:

litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py

@@ -928,10 +928,17 @@ async def update_sso_settings(sso_config: SSOConfig):
             detail={"error": f"Error updating environment_variables: {str(e)}"},
         )
 
+    # Redact secret fields in the response so plaintext secrets (including any
+    # restored from the sentinel) never leak back to the caller.
+    redacted_sso_data = {**sso_data}
+    for _secret_field in _SSO_SECRET_FIELDS:
+        if redacted_sso_data.get(_secret_field):
+            redacted_sso_data[_secret_field] = _REDACTED_SECRET
+
     return {
         "message": "SSO settings updated successfully",
         "status": "success",
-        "settings": sso_data,
+        "settings": redacted_sso_data,
     }
 
 

tests/test_litellm/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py

@@ -430,16 +430,13 @@ class TestProxySettingEndpoints:
         # Verify settings were updated
         settings = data["settings"]
         assert settings["google_client_id"] == new_sso_settings["google_client_id"]
-        assert (
-            settings["google_client_secret"] == new_sso_settings["google_client_secret"]
-        )
+        # Secret fields must be redacted in the response so plaintext does not
+        # leak back to the caller.
+        assert settings["google_client_secret"] == "**redacted**"
         assert (
             settings["microsoft_client_id"] == new_sso_settings["microsoft_client_id"]
         )
-        assert (
-            settings["microsoft_client_secret"]
-            == new_sso_settings["microsoft_client_secret"]
-        )
+        assert settings["microsoft_client_secret"] == "**redacted**"
         assert settings["proxy_base_url"] == new_sso_settings["proxy_base_url"]
         assert settings["user_email"] == new_sso_settings["user_email"]