feat(anthropic): workload identity federation, pluggable identity sources, and provider-level setup - #38013

Closed

derhornspieler wants to merge 57 commits into

BerriAI:litellm_internal_stagingfrom

derhornspieler:litellm_anthropic_wif_oidc_28607

Commits on Aug 23, 2026

feat(anthropic): workload identity federation via a shared RFC 7523 token exchange engine
derhornspieler
committed
61a1122
fix(anthropic): stop workload identity federation from reaching non-Anthropic providers
derhornspieler
committed
20da15e
fix(anthropic): keep workload identity federation out of caller-controlled request paths
derhornspieler
committed
79e4a69
feat(anthropic): pluggable identity sources for workload identity federation
derhornspieler
committed
66a3744
feat(proxy): provider-level setup for Anthropic workload identity federation
derhornspieler
committed
cb3f29d
fix(proxy): let the model table validate a row it was handed as an object
derhornspieler
committed
d626d65
chore(ui): add the new provider-setup endpoints to the dashboard API types
derhornspieler
committed
ff457a7
style(ui): apply prettier to the new provider-setup modules
derhornspieler
committed
fb4065d
fix(anthropic): redact the assertion that was actually sent, and form-encode Keycloak credentials
derhornspieler
committed
2ee90c2
fix(anthropic): mint the files and batches credential without blocking the event loop
derhornspieler
committed
3562661
fix(proxy): let only proxy admins persist Anthropic workload identity fields
derhornspieler
committed
b0a28b2
fix(ui): keep the add-provider tab after auto-routers, and drop aliases for failed rows
derhornspieler
committed
cc18f80
test(anthropic): cover the token exchange and Keycloak default posters
derhornspieler
committed
498592e
chore(ui): regenerate the dashboard API types for the split credential schema
derhornspieler
committed
3c5b467
fix(anthropic): scale the token refresh windows to the token's own lifetime
derhornspieler
committed
db268de
fix(proxy): gate every credential write path on the effective workload identity surface
derhornspieler
committed
6c89af0
fix(anthropic): stop caller keys riding upstream beside a server-minted passthrough token
derhornspieler
committed
c9063a2
ci: give the unit job the setup headroom its own startup guard requires
derhornspieler
committed
d3ee6c6
feat(anthropic): report workload identity token health as a litellm service
derhornspieler
committed
67688e1
fix(anthropic): bound the token metrics backlog so a stalled backend cannot exhaust memory
derhornspieler
committed
0a88371
refactor(anthropic): drop the recursion the workload identity paths did not need
derhornspieler
committed
0a69790
fix(proxy): read both memory and the row when authorizing a credential write
derhornspieler
committed
79b5738
fix(anthropic): keep the token cache at its bound after a burst of distinct identities
derhornspieler
committed
e71d5cf
fix(anthropic): stop annotating loop-assigned locals as Final
derhornspieler
committed
8655283
fix(anthropic): pin the federated token exchange to trusted hosts
derhornspieler
committed
d832b80
fix(ui): let the internal-issuer flow save before a federation rule id exists
derhornspieler
committed
576ada8

Commits on Aug 24, 2026

Commits on Aug 25, 2026

Commits on Aug 26, 2026

Commits on Aug 29, 2026