{"record":{"id":"9ab02eb57b6e03e1","repo":"BerriAI/litellm","slug":"oauth2-proxy-auth-refuses-to-map-non-identity-user","errorCode":null,"errorMessage":"Oauth2 proxy auth refuses to map non-identity UserAPIKeyAuth fields from request headers: {disallowed}. Only identity fields are accepted ({sorted(ALLOWED_OAUTH2_PROXY_FIELDS)}); anything else (privileges, budgets, rate limits, metadata) would let a caller forge enforcement parameters by spoofing the matching header. If you need a trusted upstream to assert anything beyond identity, use JWT auth (signature-validated) instead of header-trust.","messagePattern":"Oauth2 proxy auth refuses to map non-identity UserAPIKeyAuth fields from request headers: (.+?)\\. Only identity fields are accepted \\((.+?)\\); anything else \\(privileges, budgets, rate limits, metadata\\) would let a caller forge enforcement parameters by spoofing the matching header\\. If you need a trusted upstream to assert anything beyond identity, use JWT auth \\(signature-validated\\) instead of header-trust\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/auth/oauth2_proxy_hook.py","lineNumber":76,"sourceCode":"    \"\"\"\n    from litellm.proxy.proxy_server import general_settings\n\n    verbose_proxy_logger.debug(\"Handling oauth2 proxy request\")\n    require_trusted_proxy_request(\n        request=request,\n        general_settings=general_settings,\n        feature_name=\"OAuth2 proxy auth\",\n    )\n\n    oauth2_config_mappings: Final[dict[str, str]] = general_settings.get(\"oauth2_config_mappings\") or {}\n    verbose_proxy_logger.debug(\"Oauth2 config mappings: %s\", oauth2_config_mappings)\n\n    if not oauth2_config_mappings:\n        raise ValueError(\"Oauth2 config mappings not found in general_settings\")\n\n    disallowed: Final = sorted(set(oauth2_config_mappings.keys()) - ALLOWED_OAUTH2_PROXY_FIELDS)\n    if disallowed:\n        raise ValueError(\n            \"Oauth2 proxy auth refuses to map non-identity UserAPIKeyAuth \"\n            f\"fields from request headers: {disallowed}. Only identity \"\n            f\"fields are accepted ({sorted(ALLOWED_OAUTH2_PROXY_FIELDS)}); \"\n            \"anything else (privileges, budgets, rate limits, metadata) \"\n            \"would let a caller forge enforcement parameters by spoofing \"\n            \"the matching header. If you need a trusted upstream to \"\n            \"assert anything beyond identity, use JWT auth \"\n            \"(signature-validated) instead of header-trust.\"\n        )\n\n    auth_data: Final[Mapping[str, str | list[str]]] = {\n        key: [model.strip() for model in value.split(\",\")] if key == \"models\" else value\n        for key, header in oauth2_config_mappings.items()\n        if (value := request.headers.get(header))\n    }\n\n    verbose_proxy_logger.debug(\n        \"Auth data before creating UserAPIKeyAuth object: keys=%s\",","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/auth/oauth2_proxy_hook.py#L58-L94","documentation":"Error \"Oauth2 proxy auth refuses to map non-identity UserAPIKeyAuth fields from request headers: {disallowed}. Only identity fields are accepted ({sorted(ALLOWED_OAUTH2_PROXY_FIELDS)}); anything else (privileges, budgets, rate limits, metadata) would let a caller forge enforcement parameters by spoofing the matching header. If you need a trusted upstream to assert anything beyond identity, use JWT auth (signature-validated) instead of header-trust.\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/auth/oauth2_proxy_hook.py:76 when the library encounters an invalid state.","commonSituations":"The oauth2 proxy config tried to map enforcement fields (privileges, budgets, metadata) from spoofable request headers.","solutions":["Restrict your upstream proxy to only assert identity headers (the ALLOWED_OAUTH2_PROXY_FIELDS).","If you need trusted assertions beyond identity, switch to JWT auth so claims are signature-validated."],"exampleFix":"Remove non-identity header mappings (roles, budgets, rate limits, metadata) from the oauth2 proxy config.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}