feat(scim): provision Entra agent identities and directory groups

litellm-proxy-extras/litellm_proxy_extras/migrations/20260925220100_agent_scim/migration.sql

@@ -0,0 +1,105 @@
+ALTER TABLE "LiteLLM_AgentIdentity" ADD COLUMN IF NOT EXISTS "provisioning_source_id" TEXT;
+
+ALTER TABLE "LiteLLM_VerifiedSubject" ADD COLUMN IF NOT EXISTS "agent_id" TEXT,
+ADD COLUMN IF NOT EXISTS "parent_client_id" TEXT,
+ADD COLUMN IF NOT EXISTS "scim_resource_id" TEXT;
+
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_SCIMSource" (
+    "source_id" TEXT NOT NULL,
+    "display_name" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "key_hash" TEXT NOT NULL,
+    "enabled" BOOLEAN NOT NULL DEFAULT true,
+    "group_mappings" JSONB NOT NULL DEFAULT '[]',
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "LiteLLM_SCIMSource_pkey" PRIMARY KEY ("source_id")
+);
+
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_SCIMResource" (
+    "id" TEXT NOT NULL,
+    "source_id" TEXT NOT NULL,
+    "kind" TEXT NOT NULL,
+    "external_id" TEXT NOT NULL,
+    "user_name" TEXT,
+    "display_name" TEXT NOT NULL,
+    "document" JSONB NOT NULL,
+    "active" BOOLEAN NOT NULL DEFAULT true,
+    "deleted" BOOLEAN NOT NULL DEFAULT false,
+    "local_id" TEXT,
+    "human_email" TEXT,
+    "human_subject_key" TEXT,
+    "member_ids" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "LiteLLM_SCIMResource_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_VerifiedSubject_scim_resource_id_key" ON "LiteLLM_VerifiedSubject"("scim_resource_id");
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "LiteLLM_VerifiedSubject_agent_id_idx" ON "LiteLLM_VerifiedSubject"("agent_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_SCIMSource_key_hash_key" ON "LiteLLM_SCIMSource"("key_hash");
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "LiteLLM_SCIMResource_source_id_kind_idx" ON "LiteLLM_SCIMResource"("source_id", "kind");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_SCIMResource_source_id_kind_external_id_key" ON "LiteLLM_SCIMResource"("source_id", "kind", "external_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_SCIMResource_source_id_kind_user_name_key" ON "LiteLLM_SCIMResource"("source_id", "kind", "user_name");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_SCIMResource_local_id_key" ON "LiteLLM_SCIMResource"("local_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_SCIMResource_human_email_key" ON "LiteLLM_SCIMResource"("human_email");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_SCIMResource_human_subject_key_key" ON "LiteLLM_SCIMResource"("human_subject_key");
+
+-- AddForeignKey
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'LiteLLM_VerifiedSubject_agent_id_fkey') THEN
+        ALTER TABLE "LiteLLM_VerifiedSubject" ADD CONSTRAINT "LiteLLM_VerifiedSubject_agent_id_fkey" FOREIGN KEY ("agent_id") REFERENCES "LiteLLM_AgentsTable"("agent_id") ON DELETE SET NULL ON UPDATE CASCADE;
+    END IF;
+END $$;
+
+-- AddForeignKey
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'LiteLLM_VerifiedSubject_scim_resource_id_fkey') THEN
+        ALTER TABLE "LiteLLM_VerifiedSubject" ADD CONSTRAINT "LiteLLM_VerifiedSubject_scim_resource_id_fkey" FOREIGN KEY ("scim_resource_id") REFERENCES "LiteLLM_SCIMResource"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+    END IF;
+END $$;
+
+-- AddForeignKey
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'LiteLLM_SCIMResource_source_id_fkey') THEN
+        ALTER TABLE "LiteLLM_SCIMResource" ADD CONSTRAINT "LiteLLM_SCIMResource_source_id_fkey" FOREIGN KEY ("source_id") REFERENCES "LiteLLM_SCIMSource"("source_id") ON DELETE RESTRICT ON UPDATE CASCADE;
+    END IF;
+END $$;
+
+-- AddCheckConstraint
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'LiteLLM_VerifiedSubject_kind_shape') THEN
+        ALTER TABLE "LiteLLM_VerifiedSubject" ADD CONSTRAINT "LiteLLM_VerifiedSubject_kind_shape" CHECK (
+            ("kind" = 'human' AND "user_id" IS NOT NULL AND "agent_id" IS NULL
+                AND "parent_client_id" IS NULL AND "scim_resource_id" IS NULL AND "verified_via" = 'sso_interactive')
+            OR
+            ("kind" = 'agent_user' AND "user_id" IS NULL AND "parent_client_id" IS NOT NULL
+                AND "scim_resource_id" IS NOT NULL AND "verified_via" = 'scim')
+        );
+    END IF;
+END $$;

litellm-proxy-extras/litellm_proxy_extras/schema.prisma

@@ -85,8 +85,9 @@ model LiteLLM_AgentsTable {
   identity LiteLLM_AgentIdentity?
   retired_identities LiteLLM_RetiredAgentIdentity[]
   budget_id String? @unique
-  spend_window        DateTime?
+  spend_window DateTime?
   litellm_budget_table LiteLLM_BudgetTable? @relation(fields: [budget_id], references: [budget_id])
+  verified_subjects LiteLLM_VerifiedSubject[]
   tpm_limit  Int?
   rpm_limit  Int?
   session_tpm_limit Int?
@@ -106,6 +107,7 @@ model LiteLLM_AgentIdentity {
   tenant_id String
   client_id String
   service_principal_id String?
+  provisioning_source_id String?
   required_roles String[] @default([])
   required_scopes String[] @default(["user_impersonation"])
   revision String @default(uuid())
@@ -138,13 +140,52 @@ model LiteLLM_VerifiedSubject {
   kind String @default("human")
   user_id String?
   user LiteLLM_UserTable? @relation(fields: [user_id], references: [user_id], onDelete: Cascade)
+  agent_id String?
+  agent LiteLLM_AgentsTable? @relation(fields: [agent_id], references: [agent_id], onDelete: SetNull)
+  parent_client_id String?
+  scim_resource_id String? @unique
+  scim_resource LiteLLM_SCIMResource? @relation(fields: [scim_resource_id], references: [id], onDelete: Restrict)
   verified_via String @default("sso_interactive")
   verified_at DateTime @default(now())
   @@unique([issuer, tenant_id, oid])
   @@index([user_id])
+  @@index([agent_id])
 }
 
+model LiteLLM_SCIMSource {
+  source_id String @id @default(uuid())
+  display_name String
+  tenant_id String
+  key_hash String @unique
+  enabled Boolean @default(true)
+  group_mappings Json @default("[]")
+  resources LiteLLM_SCIMResource[]
+  created_at DateTime @default(now())
+  updated_at DateTime @updatedAt
+}
 
+model LiteLLM_SCIMResource {
+  id String @id @default(uuid())
+  source_id String
+  source LiteLLM_SCIMSource @relation(fields: [source_id], references: [source_id], onDelete: Restrict)
+  kind String
+  external_id String
+  user_name String?
+  display_name String
+  document Json
+  active Boolean @default(true)
+  deleted Boolean @default(false)
+  local_id String? @unique
+  human_email String? @unique
+  human_subject_key String? @unique
+  member_ids String[] @default([])
+  subject LiteLLM_VerifiedSubject?
+  created_at DateTime @default(now())
+  updated_at DateTime @updatedAt
+  @@unique([source_id, kind, external_id])
+  @@unique([source_id, kind, user_name])
+  @@index([source_id, kind])
+}
 
 
 model LiteLLM_OrganizationTable {
@@ -300,6 +341,7 @@ model LiteLLM_DeletedTeamTable {
 
 // Track spend, rate limit, budget Users
 model LiteLLM_UserTable {
+
     verified_subjects LiteLLM_VerifiedSubject[]
 		user_id    String @id
     user_alias String?