mirror of
https://github.com/tiennm99/litellm.git
synced 2026-07-30 10:22:35 +00:00
Krish DholakiaandGitHub
2290250c9f
* docs(index.md): add new models / updated models to new release note * docs(index.md): add LLM api endpoints to release notes * docs(index.md): refactor mcp into separate section ' * docs: doc improvements * docs(index.md): more cleanup * docs(index.md): more cleanup * docs: update litellm enterprise trial link * docs(index.md): cleanup * docs(datadog.md): add separate datadog doc * docs(index.md): cleanup * docs(index.md): update docker version * docs(index.md): add screenshots for new features * docs(index.md): add doc links
3.4 KiB
3.4 KiB
import Image from '@theme/IdealImage'; import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem';
Control Model Access with OIDC (Azure AD/Keycloak/etc.)
:::info
✨ JWT Auth is on LiteLLM Enterprise
:::
<Image img={require('../../img/control_model_access_jwt.png')} style={{ width: '100%', maxWidth: '4000px' }} />
Example Token
{
"sub": "1234567890",
"name": "John Doe",
"email": "john.doe@example.com",
"roles": ["basic_user"] # 👈 ROLE
}
{
"sub": "1234567890",
"name": "John Doe",
"email": "john.doe@example.com",
"resource_access": {
"litellm-test-client-id": {
"roles": ["basic_user"] # 👈 ROLE
}
}
}
Proxy Configuration
general_settings:
enable_jwt_auth: True
litellm_jwtauth:
user_roles_jwt_field: "roles" # the field in the JWT that contains the roles
user_allowed_roles: ["basic_user"] # roles that map to an 'internal_user' role on LiteLLM
enforce_rbac: true # if true, will check if the user has the correct role to access the model
role_permissions: # control what models are allowed for each role
- role: internal_user
models: ["anthropic-claude"]
model_list:
- model: anthropic-claude
litellm_params:
model: claude-3-5-haiku-20241022
- model: openai-gpt-4o
litellm_params:
model: gpt-4o
general_settings:
enable_jwt_auth: True
litellm_jwtauth:
user_roles_jwt_field: "resource_access.litellm-test-client-id.roles" # the field in the JWT that contains the roles
user_allowed_roles: ["basic_user"] # roles that map to an 'internal_user' role on LiteLLM
enforce_rbac: true # if true, will check if the user has the correct role to access the model
role_permissions: # control what models are allowed for each role
- role: internal_user
models: ["anthropic-claude"]
model_list:
- model: anthropic-claude
litellm_params:
model: claude-3-5-haiku-20241022
- model: openai-gpt-4o
litellm_params:
model: gpt-4o
How it works
-
Specify JWT_PUBLIC_KEY_URL - This is the public keys endpoint of your OpenID provider. For Azure AD it's
https://login.microsoftonline.com/{tenant_id}/discovery/v2.0/keys. For Keycloak it's{keycloak_base_url}/realms/{your-realm}/protocol/openid-connect/certs. -
Map JWT roles to LiteLLM roles - Done via
user_roles_jwt_fieldanduser_allowed_roles- Currently just
internal_useris supported for role mapping.
- Currently just
-
Specify model access:
role_permissions: control what models are allowed for each role.role: the LiteLLM role to control access for. Allowed roles = ["internal_user", "proxy_admin", "team"]models: list of models that the role is allowed to access.
model_list: parent list of models on the proxy. Learn more
-
Model Checks: The proxy will run validation checks on the received JWT. Code