scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-08 03:08:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 115

address greptile review feedback (greploop iteration 21)

Browse source
This commit is contained in:
Ishaan Jaffer 2026-03-05 18:52:09 -08:00
parent cd4d672f7e
commit b7df1f3d1b
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
litellm/proxy/management_endpoints/ui_sso.py
View file

@ -1973,7 +1973,7 @@ class SSOAuthenticationHandler:
) = SSOAuthenticationHandler.generate_pkce_params()
redirect_params["code_challenge"] = code_challenge
redirect_params["code_challenge_method"] = "S256"
verbose_proxy_logger.info("PKCE enabled for authorization request")
verbose_proxy_logger.debug("PKCE enabled for authorization request")
return redirect_params, code_verifier
@ -2763,9 +2763,11 @@ class SSOAuthenticationHandler:
additional_headers=additional_headers,
)
# Merge with token_response taking precedence so token fields (e.g. access_token)
# cannot be overridden by non-standard userinfo fields.
return {**userinfo, **token_response}
# Merge: userinfo takes precedence for identity claims (sub, email, name, …) per
# the OpenID Connect spec (userinfo is the authoritative source for identity).
# token_response provides bearer credentials (access_token, id_token, refresh_token,
# token_type, expires_in) that userinfo endpoints do not return, so they are preserved.
return {**token_response, **userinfo}
@staticmethod
async def _get_pkce_userinfo(