{"record":{"id":"4efd96c36051941c","repo":"BerriAI/litellm","slug":"oauth2-config-mappings-not-found-in-general-settin","errorCode":null,"errorMessage":"Oauth2 config mappings not found in general_settings","messagePattern":"Oauth2 config mappings not found in general_settings","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/auth/oauth2_proxy_hook.py","lineNumber":72,"sourceCode":"    ``ALLOWED_OAUTH2_PROXY_FIELDS`` (identity assertion only — see the\n    constant's comment) may be mapped; any other mapping is rejected at\n    request time so the misconfiguration surfaces loudly rather than as\n    a silent privesc.\n    \"\"\"\n    from litellm.proxy.proxy_server import general_settings\n\n    verbose_proxy_logger.debug(\"Handling oauth2 proxy request\")\n    require_trusted_proxy_request(\n        request=request,\n        general_settings=general_settings,\n        feature_name=\"OAuth2 proxy auth\",\n    )\n\n    oauth2_config_mappings: Final[dict[str, str]] = general_settings.get(\"oauth2_config_mappings\") or {}\n    verbose_proxy_logger.debug(\"Oauth2 config mappings: %s\", oauth2_config_mappings)\n\n    if not oauth2_config_mappings:\n        raise ValueError(\"Oauth2 config mappings not found in general_settings\")\n\n    disallowed: Final = sorted(set(oauth2_config_mappings.keys()) - ALLOWED_OAUTH2_PROXY_FIELDS)\n    if disallowed:\n        raise ValueError(\n            \"Oauth2 proxy auth refuses to map non-identity UserAPIKeyAuth \"\n            f\"fields from request headers: {disallowed}. Only identity \"\n            f\"fields are accepted ({sorted(ALLOWED_OAUTH2_PROXY_FIELDS)}); \"\n            \"anything else (privileges, budgets, rate limits, metadata) \"\n            \"would let a caller forge enforcement parameters by spoofing \"\n            \"the matching header. If you need a trusted upstream to \"\n            \"assert anything beyond identity, use JWT auth \"\n            \"(signature-validated) instead of header-trust.\"\n        )\n\n    auth_data: Final[Mapping[str, str | list[str]]] = {\n        key: [model.strip() for model in value.split(\",\")] if key == \"models\" else value\n        for key, header in oauth2_config_mappings.items()\n        if (value := request.headers.get(header))","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/auth/oauth2_proxy_hook.py#L54-L90","documentation":"Config guard in the OAuth2-proxy auth hook: general_settings contains no oauth2 config mappings (oauth2_config), so header-to-identity mapping cannot run and the request cannot be authenticated via OAuth2 proxy headers.","triggerScenarios":"Thrown at litellm/proxy/auth/oauth2_proxy_hook.py:72 when the library encounters an invalid state.","commonSituations":"The OAuth2 proxy hook is enabled but no config mappings exist in general_settings.","solutions":["Add the oauth2 config mappings under general_settings in your proxy config.yaml."],"exampleFix":"general_settings:\n  oauth2_config_mappings:\n    user_id_header: X-User-Id","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}