{"record":{"id":"291466af57833b62","repo":"BerriAI/litellm","slug":"oidc-userinfo-endpoint-not-configured-set-oidc-u","errorCode":null,"errorMessage":"OIDC UserInfo endpoint not configured. Set 'oidc_userinfo_endpoint' in JWT auth config.","messagePattern":"OIDC UserInfo endpoint not configured\\. Set 'oidc_userinfo_endpoint' in JWT auth config\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"litellm/proxy/auth/handle_jwt.py","lineNumber":744,"sourceCode":"    async def get_oidc_userinfo(self, token: str) -> dict:\n        \"\"\"\n        Fetch user information from OIDC UserInfo endpoint.\n\n        This follows the OpenID Connect protocol where an access token\n        is sent to the identity provider's UserInfo endpoint to retrieve\n        user identity information.\n\n        Args:\n            token: The access token to use for authentication\n\n        Returns:\n            dict: User information from the UserInfo endpoint\n\n        Raises:\n            Exception: If UserInfo endpoint is not configured or request fails\n        \"\"\"\n        if not self.litellm_jwtauth.oidc_userinfo_endpoint:\n            raise Exception(\"OIDC UserInfo endpoint not configured. Set 'oidc_userinfo_endpoint' in JWT auth config.\")\n\n        # Check cache first\n        cache_key: Final = f\"oidc_userinfo_{hashlib.sha256(token.encode()).hexdigest()}\"\n        cached_userinfo: Final = await self.user_api_key_cache.async_get_cache(cache_key)\n\n        if cached_userinfo is not None:\n            verbose_proxy_logger.debug(\"Returning cached OIDC UserInfo\")\n            return cached_userinfo\n\n        verbose_proxy_logger.debug(\"Calling OIDC UserInfo endpoint: %s\", self.litellm_jwtauth.oidc_userinfo_endpoint)\n\n        try:\n            # Call the UserInfo endpoint with the access token\n            response: Final = await self.http_handler.get(\n                url=self.litellm_jwtauth.oidc_userinfo_endpoint,\n                headers={\n                    \"Authorization\": f\"Bearer {token}\",\n                    \"Accept\": \"application/json\",","sourceCodeStart":726,"sourceCodeEnd":762,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/auth/handle_jwt.py#L726-L762","documentation":"Raised at the top of get_userinfo in litellm/proxy/auth/handle_jwt.py: the OIDC UserInfo flow was triggered (the proxy wants to fetch user claims from the IdP's UserInfo endpoint) but litellm_jwtauth.oidc_userinfo_endpoint is not set in the JWT auth config. This is a configuration gap, not a runtime failure of the IdP.","triggerScenarios":"A JWT-authenticated request reaches a code path that calls get_userinfo (e.g. resolving user identity/roles from UserInfo instead of token claims) while the config yaml's litellm_jwtauth section has no oidc_userinfo_endpoint key.","commonSituations":"Enabling OIDC login or claim mapping that relies on UserInfo without adding the endpoint; copying a minimal JWT auth config sample that omits OIDC extras; assuming the endpoint is auto-discovered from the discovery document (it is not - it must be configured explicitly).","solutions":["Add oidc_userinfo_endpoint to the litellm_jwtauth config, pointing at the IdP's UserInfo URL (the userinfo_endpoint value in the OIDC discovery document)","Verify the URL by calling it manually with a bearer token before wiring it in","If you do not need UserInfo-based identity, disable the flow that calls it (fall back to token claims) instead of configuring an endpoint"],"exampleFix":"# config.yaml - before\nlitellm_settings:\n  litellm_jwtauth:\n    jwt_public_key_url: https://idp.example.com/certs\n\n# config.yaml - after\nlitellm_settings:\n  litellm_jwtauth:\n    jwt_public_key_url: https://idp.example.com/certs\n    oidc_userinfo_endpoint: https://idp.example.com/userinfo","handlingStrategy":"validation","validationCode":"def validate_jwt_auth_config(config: dict) -> None:\n    jwtauth = config.get(\"litellm_settings\", {}).get(\"litellm_jwtauth\", {})\n    if jwtauth.get(\"oidc_userinfo_enabled\") and not jwtauth.get(\"oidc_userinfo_endpoint\"):\n        raise ValueError(\"oidc_userinfo_endpoint is required when the UserInfo flow is enabled\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Schema-check the litellm_jwtauth block in CI whenever OIDC features are enabled","Copy the userinfo_endpoint value from the IdP's published discovery document, not from memory"],"tags":["oidc","userinfo","configuration","jwt","authentication"],"backgroundTag":"missing-configuration","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}