{"record":{"id":"a584656f46a28eb2","repo":"BerriAI/litellm","slug":"userinfo","errorCode":"userinfo","errorMessage":"Failed to decode id_token JWT: {decode_err}","messagePattern":"Failed to decode id_token JWT: (.+?)","errorType":"exception","errorClass":"ProxyException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/ui_sso.py","lineNumber":4123,"sourceCode":"                verbose_proxy_logger.warning(\"Userinfo endpoint error: %s, falling back to id_token\", e)\n\n        # Only fall back to id_token when the userinfo request failed (None).\n        # Empty dict ({}) and JSON null are both treated as failure (set to None above) since\n        # they contain no identity claims — id_token fallback is attempted in that case too.\n        # Explicitly check for a non-empty string to avoid attempting JWT decode on\n        # a blank or non-string id_token field from a misbehaving provider.\n        if userinfo is None and isinstance(id_token, str) and id_token:\n            try:\n                userinfo = jwt.decode(id_token, options={\"verify_signature\": False})\n                if not userinfo:\n                    # jwt.decode returned an empty dict (payload-free JWT or provider bug).\n                    # Treat this the same as a missing userinfo — the session would have no\n                    # identity claims, which is equivalent to a broken session.\n                    verbose_proxy_logger.warning(\"id_token decoded to an empty payload — treating as failure.\")\n                    userinfo = None\n            except Exception as decode_err:\n                verbose_proxy_logger.error(\"Failed to decode id_token: %s\", decode_err)\n                raise ProxyException(\n                    message=f\"Failed to decode id_token JWT: {decode_err}\",\n                    type=ProxyErrorTypes.auth_error,\n                    param=\"userinfo\",\n                    code=status.HTTP_401_UNAUTHORIZED,\n                )\n\n        if userinfo is None:\n            id_token_attempted: Final = isinstance(id_token, str) and bool(id_token)\n            if userinfo_endpoint:\n                if id_token_attempted:\n                    detail = (\n                        \"userinfo endpoint failed and id_token was present but \"\n                        \"decoded to an empty payload — no identity claims available\"\n                    )\n                else:\n                    detail = \"userinfo endpoint failed and no id_token was present in the token response\"\n            else:\n                if id_token_attempted:","sourceCodeStart":4105,"sourceCodeEnd":4141,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/ui_sso.py#L4105-L4141","documentation":"ProxyException raised during SSO login fallback: the userinfo endpoint failed, so LiteLLM attempts to decode the id_token JWT to recover identity claims, and that decode throws (malformed JWT, bad base64, wrong signing setup). The decode error text is embedded; the login cannot establish identity.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/ui_sso.py:4123 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the IdP returns a valid JWT id_token; check token signing/algorithms configuration and proxy logs."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}