scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-08 03:08:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 115

fix(openai): let workload identity federation target the regional api.openai.com hosts

Browse source
This commit is contained in:
mateo-berri 2026-09-03 13:40:18 -07:00
parent 994c6f0d55
commit fe6a5351ee
2 changed files with 21 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
litellm/llms/openai/workload_identity.py
View file

@ -18,6 +18,7 @@ if TYPE_CHECKING:
OPENAI_WIF_CLIENT_ID: Final = "litellm"
_OPENAI_API_HOST: Final = "api.openai.com"
_OPENAI_REGIONAL_HOST_SUFFIX: Final = f".{_OPENAI_API_HOST}"
_SDK_UPGRADE_MESSAGE: Final = (
"OpenAI workload identity federation requires openai>=2.32.0. "
"Upgrade the installed openai package to use OPENAI_IDENTITY_PROVIDER_ID / "
@ -86,7 +87,9 @@ def _targets_openai_api(api_base: str | None) -> bool:
if api_base is None:
return True
parsed: Final = urlparse(api_base)
return parsed.scheme == "https" and parsed.hostname == _OPENAI_API_HOST
if parsed.scheme != "https" or parsed.hostname is None:
return False
return parsed.hostname == _OPENAI_API_HOST or parsed.hostname.endswith(_OPENAI_REGIONAL_HOST_SUFFIX)
@lru_cache(maxsize=16)

17
tests/test_litellm/llms/openai/test_openai_workload_identity.py
View file

@ -97,6 +97,23 @@ class TestResolveConfig:
def test_plaintext_http_api_base_disables(self, wif_env: OpenAIWorkloadIdentityConfig) -> None:
assert resolve_openai_workload_identity_config(api_key=None, api_base="http://api.openai.com/v1") is None
@pytest.mark.parametrize("regional_host", ("eu.api.openai.com", "us.api.openai.com"))
def test_regional_openai_api_base_allows(
self, wif_env: OpenAIWorkloadIdentityConfig, regional_host: str
) -> None:
assert (
resolve_openai_workload_identity_config(api_key=None, api_base=f"https://{regional_host}/v1") == wif_env
)
@pytest.mark.parametrize(
"lookalike_base",
("https://api.openai.com.evil.example/v1", "https://openai.com/v1", "https://euapi.openai.com/v1"),
)
def test_openai_lookalike_api_base_disables(
self, wif_env: OpenAIWorkloadIdentityConfig, lookalike_base: str
) -> None:
assert resolve_openai_workload_identity_config(api_key=None, api_base=lookalike_base) is None
def test_foreign_env_base_url_disables(
self, wif_env: OpenAIWorkloadIdentityConfig, monkeypatch: pytest.MonkeyPatch
) -> None: