{"record":{"id":"086ad5655c54e407","repo":"BerriAI/litellm","slug":"user-allowed-roles-must-be-provided-if-user-roles","errorCode":null,"errorMessage":"user_allowed_roles must be provided if user_roles_jwt_field is set.","messagePattern":"user_allowed_roles must be provided if user_roles_jwt_field is set\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/_types.py","lineNumber":4649,"sourceCode":"        object_id_jwt_field: Final = kwargs.get(\"object_id_jwt_field\")\n        role_mappings: Final = kwargs.get(\"role_mappings\")\n        scope_mappings: Final = kwargs.get(\"scope_mappings\")\n        enforce_scope_based_access: Final = kwargs.get(\"enforce_scope_based_access\")\n        custom_validate: Final = kwargs.get(\"custom_validate\")\n\n        if custom_validate is not None:\n            fn: Final = get_instance_fn(custom_validate, config_file_path=config_file_path)\n            validate_custom_validate_return_type(fn)\n            kwargs[\"custom_validate\"] = fn\n\n        if invalid_keys:\n            raise ValueError(\n                f\"Invalid arguments provided: {', '.join(invalid_keys)}. Allowed arguments are: {', '.join(allowed_keys)}.\"\n            )\n        if (user_roles_jwt_field is not None and user_allowed_roles is None) or (\n            user_roles_jwt_field is None and user_allowed_roles is not None\n        ):\n            raise ValueError(\"user_allowed_roles must be provided if user_roles_jwt_field is set.\")\n\n        if object_id_jwt_field is not None and role_mappings is None:\n            raise ValueError(\n                \"if object_id_jwt_field is set, role_mappings must also be set. Needed to infer if the caller is a user or team.\"\n            )\n\n        if scope_mappings is not None and not enforce_scope_based_access:\n            raise ValueError(\"scope_mappings must be set if enforce_scope_based_access is true.\")\n\n        super().__init__(**kwargs)\n\n\nclass PrismaCompatibleUpdateDBModel(TypedDict, total=False):\n    model_name: str\n    litellm_params: str\n    model_info: str\n    blocked: bool\n    updated_at: str","sourceCodeStart":4631,"sourceCodeEnd":4667,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_types.py#L4631-L4667","documentation":"Raised while parsing the general_settings JWT auth block when user_roles_jwt_field is configured (so JWT role claims will be mapped to LiteLLM roles) but user_allowed_roles is absent. Without the allowed-roles list there is no way to decide which mapped roles may authenticate, so the config is rejected at startup rather than producing undefined auth behavior.","triggerScenarios":"Thrown at litellm/proxy/_types.py:4649 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide user_allowed_roles when user_roles_jwt_field is set."],"exampleFix":"user_allowed_roles=['admin','user']","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}