Skip to content

Add a config to forward user headers to litellm internal user #14423

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Add a config to forward user headers to litellm internal user #14423

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions litellm/proxy/auth/auth_utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -481,10 +481,22 @@ def get_end_user_id_from_request_body(
# and to ensure it's fetched at runtime.
from litellm.proxy.proxy_server import general_settings

# Config gate: If `general_settings.user_header_target == "internal_user"`,
# we should NOT use the forwarded header to populate End User.
# This ensures we don't duplicate the value into both Internal and End User fields.
_map_to_internal_user = False
try:
_map_to_internal_user = (
isinstance(general_settings.get("user_header_target"), str)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we not do it this way. Instead have a field called user_header_mappings like this: https://docs.litellm.ai/docs/proxy/token_auth#role-mapping-spec

then u can say
X-Open-Header: internal_user
X-Open-Email: end_user

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please also add validation that the value entered e.g internal_user, end_user is a valid role. We this defined in proxy/_types.py

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ishaan-jaff, should I make a backward-compatible change by keeping the existing field user_header_name behavior, or should I remove it because the user_header_mappings field will contain it?

user_header_mappings:
- header_name: X-OpenWebUI-User-Email
litellm_user_role: internal_user
- header_name: X-OpenWebUI-User-Email
litellm_user_role: external_user

and general_settings.get("user_header_target", "").lower()
== "internal_user"
)
except Exception:
_map_to_internal_user = False

# Check 1: Custom Header from general_settings.user_header_name (only if request_headers is provided)
# User query: "system not respecting user_header_name property"
# This implies the key in general_settings is 'user_header_name'.
if request_headers is not None:
# Skip using header as End User when mapping-to-internal-user is enabled by config.
if request_headers is not None and _map_to_internal_user is not True:
user_id_header_config_key = "user_header_name"

custom_header_name_to_check = general_settings.get(user_id_header_config_key)
Expand Down
23 changes: 21 additions & 2 deletions litellm/proxy/litellm_pre_call_utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -729,8 +729,27 @@ async def add_litellm_data_to_request( # noqa: PLR0915
# Parse user info from headers
user = LiteLLMProxyRequestSetup.get_user_from_headers(_headers, general_settings)
if user is not None:
if user_api_key_dict.end_user_id is None:
user_api_key_dict.end_user_id = user
# Config gate: If `general_settings.user_header_target == "internal_user"`,
# map the forwarded user header to Internal User (user_id) instead of End User (end_user_id).
# Default behavior (no config) keeps mapping to End User
_map_to_internal_user = False
if general_settings is not None:
try:
_map_to_internal_user = (
isinstance(general_settings.get("user_header_target"), str)
and general_settings.get("user_header_target", "").lower()
== "internal_user"
)
except Exception:
_map_to_internal_user = False

if _map_to_internal_user is True:
# Set Internal User
user_api_key_dict.user_id = user
else:
# Default behavior: set End User
if user_api_key_dict.end_user_id is None:
user_api_key_dict.end_user_id = user
if "user" not in data:
data["user"] = user

Expand Down
Loading