feat(auth_v2): standards-based auth and identity module - #30171

Draft

yassin-berriai wants to merge 55 commits into

litellm_internal_stagingfrom

litellm_fix/auth-module

Commits on Jun 11, 2026

build(auth_v2): add Authlib and scim2-models for the auth_v2 module
yassin-berriai
committed
2bbf688
feat(auth_v2): add standards-based auth and identity module
yassin-berriai
committed
a0a59a2
feat(auth_v2): implement full SAML 2.0 SP via pysaml2
yassin-berriai
committed
0b74ffa
refactor(auth_v2): align SamlConfig with the revised design doc
yassin-berriai
committed
677762b
feat(auth_v2): redirect after SAML ACS with validated RelayState
yassin-berriai
committed
da1a088
test(auth_v2): add test suite for the standards-based auth module
yassin-berriai
committed
03facce
fix(auth_v2): require scim:write auth on all SCIM routes
yassin-berriai
committed
d3878ee
test(auth_v2): cover SCIM scim:write guard and SAML RelayState redirect
yassin-berriai
committed
7cf35cc
feat(auth_v2): back RBAC with Casbin
yassin-berriai
committed
e309003
test(auth_v2): cover OAuth2 token introspection over the cached async client
yassin-berriai
committed
3dc660a
test(auth_v2): cover Casbin-backed RBAC hierarchy and permissions
yassin-berriai
committed
55a332b
refactor(auth_v2): move module under litellm/proxy/auth_v2
yassin-berriai
committed
104a5e1
test(auth_v2): move tests under proxy/ to mirror the module relocation
yassin-berriai
committed
2dd336a
fix(auth_v2): harden HTTP basic, SAML sessions, and JWKS fetch
yassin-berriai
committed
71a189b
fix(auth_v2): make SCIM discovery public and return 404 on missing DELETE
yassin-berriai
committed
ca896ac
fix(auth_v2): close mTLS spoofing, introspection audience, SAML replay, and deactivated-user gaps
yassin-berriai
committed
6f3fc5e
fix(auth_v2): honor nested SCIM patch paths, align /Schemas, unshadow filter
yassin-berriai
committed
4503499
test(auth_v2): pin the hardened auth behaviors from the security fixes
yassin-berriai
committed
c512a49
refactor(auth_v2): replace install_auth with AuthSecurity DI
yassin-berriai
committed
8302f55
docs(auth_v2): one-line docstrings on AuthSecurity Security() entrypoints (D1)
yassin-berriai
committed
4ec4830
fix(auth_v2): authenticate OIDC login sessions and adapt SCIM to AuthSecurity
yassin-berriai
committed
5f02c88
test(auth_v2): adapt the suite to the AuthSecurity refactor and renames
yassin-berriai
committed
0ee4397
refactor(auth_v2): split oidc/saml/scim into sub-packages
yassin-berriai
committed
9b9cc60
fix(auth_v2): close token-claim privilege escalation and related hardening
yassin-berriai
committed
422c4df
fix(auth_v2): reject SCIM id mutation and SCIM-shape auth errors
yassin-berriai
committed
7550968
fix(auth_v2): complete the freeze batch (re-exports, SCIM error helper, bounded SAML login state)
yassin-berriai
committed
fec8e0a
refactor(auth_v2): drop duplicate SCIM error helper and private re-exports
yassin-berriai
committed
a9be3d2
test(auth_v2): repoint to frozen sub-package layout and pin H1 group provisioning
yassin-berriai
committed
341e75a
fix(auth_v2): gate OIDC login roles through the provider allowlist
yassin-berriai
committed
fc6d51c
fix(auth_v2): enforce the role allowlist on the SAML SSO path too
yassin-berriai
committed
99efd31
test(auth_v2): pin the token-claim hardening and provisioning security fixes
yassin-berriai
committed
200f674
ci(auth_v2): run the proxy auth_v2 suite with xmlsec1 in the proxy-auth shard
yassin-berriai
committed
44ac504
test(auth_v2): pin the role allowlist on the OIDC-login and SAML-SSO paths
yassin-berriai
committed
ac971d7
ci(auth_v2): run auth_v2 tests in a dedicated shard to avoid test_models basename clash
yassin-berriai
committed
f158a6c
fix(auth_v2): prefer verified mTLS cert and confirm forwarded-DN gates on the socket peer
yassin-berriai
committed
c9e7fd8
test(auth_v2): pin the mTLS forwarded-DN gate against XFF spoofing
yassin-berriai
committed
a7f9d5d
fix(auth_v2): match request paths with keyMatch so obj patterns span segments
yassin-berriai
committed
e989016
test(auth_v2): pin multi-segment path authorization (keyMatch)
yassin-berriai
committed
2fad79b
test(auth_v2): cover deep SCIM path under keyMatch and drop stale comment
yassin-berriai
committed
343909d
refactor: authv2
yassin-berriai
committed
c71291f
fix: refactor
yassin-berriai
committed
4ebb7bb

Commits on Jun 12, 2026

Commits on Jun 13, 2026

Commits on Jun 17, 2026

feat(auth_v2): add project and end_user identity to Principal
yassin-berriai
committed
03f1c11

Commits on Jun 19, 2026

refactor(auth_v2): rename resolver classes, drop dead protocol boilerplate
yassin-berriai
committed
770ae59

Commits on Jul 7, 2026

Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_fix/auth-module
yassin-berriai
committed
7eb9cbf

Commits on Jul 8, 2026

Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_fix/auth-module
yassin-berriai
committed
b9859e0

Commits on Jul 15, 2026

Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_fix/auth-module
yassin-berriai
committed
c0f6c9c

Commits on Jul 17, 2026

Merge branch 'litellm_internal_staging' into litellm_fix/auth-module
yassin-berriai
committed
64b59f4