BerriAI/litellm · error · HTTPException

The email domain={email_domain}, is not an allowed email dom

Error message

The email domain={email_domain}, is not an allowed email domain={allowed_domains}. Contact your admin to change this.

What it means

Error "The email domain={email_domain}, is not an allowed email domain={allowed_domains}. Contact your admin to change this." thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_endpoints/ui_sso.py:3400

            return None

    @staticmethod
    def _get_user_email_and_id_from_result(
        result: OpenID | dict | None,
        generic_client_id: str | None = None,
    ) -> ParsedOpenIDResult:
        """
        Gets the user email and id from the OpenID result after validating the email domain
        """
        user_email: str | None = normalize_email(getattr(result, "email", None))
        user_id: str | None = getattr(result, "id", None) if result is not None else None
        user_role: str | None = None

        if user_email is not None and os.getenv("ALLOWED_EMAIL_DOMAINS") is not None:
            email_domain: Final = user_email.split("@")[1]
            allowed_domains: Final = os.getenv("ALLOWED_EMAIL_DOMAINS").split(",")
            if email_domain not in allowed_domains:
                raise HTTPException(
                    status_code=401,
                    detail={
                        "message": f"The email domain={email_domain}, is not an allowed email domain={allowed_domains}. Contact your admin to change this."
                    },
                )

        # Extract user_role from result (works for all SSO providers)
        if result is not None:
            _user_role: Final = getattr(result, "user_role", None)
            if _user_role is not None:
                # Convert enum to string if needed
                user_role = _user_role.value if isinstance(_user_role, LitellmUserRoles) else _user_role
                verbose_proxy_logger.debug("Extracted user_role from SSO result: %s", user_role)

        # generic client id - override with custom attribute name if specified
        if generic_client_id is not None and result is not None:
            generic_user_role_attribute_name: Final = os.getenv("GENERIC_USER_ROLE_ATTRIBUTE", "role")
            user_id = getattr(result, "id", None)

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Sign in with an allowed email domain, or ask the admin to add the domain to the allowed domains list.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/ui_sso.py:3400 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/d67ffae740567bf6. Report an issue: GitHub.