From 3f4ba9f03f62ed15281749c23a1b6cdc008cf7ee Mon Sep 17 00:00:00 2001 From: Julio Quinteros Pro Date: Sat, 14 Feb 2026 15:39:39 -0300 Subject: [PATCH 1/2] Fix JWT auth email domain validation error message Fixes issue where users with disallowed email domains receive a generic "user doesn't exist" error instead of a clear message about the email domain not being allowed. Changes: - Add explicit check for valid_user_email before get_user_object - Raise ProxyException with clear error message when email domain is not in the allowed list - Prevents confusing error message for email domain restrictions This fixes the test_allow_access_by_email test failure. Co-Authored-By: Claude Sonnet 4.5 --- litellm/proxy/auth/handle_jwt.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py index 15056cf64e6..f5c39230285 100644 --- a/litellm/proxy/auth/handle_jwt.py +++ b/litellm/proxy/auth/handle_jwt.py @@ -1066,6 +1066,15 @@ class JWTAuthManager: f"JWT Auth: Resolved org_alias='{org_alias}' to org_id='{org_object.organization_id}'" ) + # Check if email domain is allowed before attempting to get/create user + if valid_user_email is False: + raise ProxyException( + message=f"Email domain not allowed. User email: {user_email}. Allowed domain: {jwt_handler.litellm_jwtauth.user_allowed_email_domain}", + type=ProxyErrorTypes.auth_error, + param="user_email", + code=403, + ) + user_object: Optional[LiteLLM_UserTable] = None if user_id: user_object = ( From 90d61432cf50a820abef0c5152191c413cc42da7 Mon Sep 17 00:00:00 2001 From: Julio Quinteros Pro Date: Sat, 14 Feb 2026 15:44:02 -0300 Subject: [PATCH 2/2] Fix LiteLLM_JWTAuth annotations access bug The __init__ method was trying to access self.__annotations__ before super().__init__() was called, resulting in an empty annotations dict. Changed to use the class annotations directly: LiteLLM_JWTAuth.__annotations__ instead of self.__annotations__. This fixes the ValueError: "Invalid arguments provided: user_email_jwt_field, user_id_upsert, user_allowed_email_domain. Allowed arguments are: ." Co-Authored-By: Claude Sonnet 4.5 --- litellm/proxy/_types.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index 45476900a26..68d0ed2bb7a 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -3776,7 +3776,7 @@ class LiteLLM_JWTAuth(LiteLLMPydanticObjectBase): def __init__(self, **kwargs: Any) -> None: # get the attribute names for this Pydantic model - allowed_keys = self.__annotations__.keys() + allowed_keys = LiteLLM_JWTAuth.__annotations__.keys() invalid_keys = set(kwargs.keys()) - allowed_keys user_roles_jwt_field = kwargs.get("user_roles_jwt_field")