{"record":{"id":"d67ffae740567bf6","repo":"BerriAI/litellm","slug":"the-email-domain-email-domain-is-not-an-allowed","errorCode":null,"errorMessage":"The email domain={email_domain}, is not an allowed email domain={allowed_domains}. Contact your admin to change this.","messagePattern":"The email domain=(.+?), is not an allowed email domain=(.+?)\\. Contact your admin to change this\\.","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/ui_sso.py","lineNumber":3400,"sourceCode":"            return None\n\n    @staticmethod\n    def _get_user_email_and_id_from_result(\n        result: OpenID | dict | None,\n        generic_client_id: str | None = None,\n    ) -> ParsedOpenIDResult:\n        \"\"\"\n        Gets the user email and id from the OpenID result after validating the email domain\n        \"\"\"\n        user_email: str | None = normalize_email(getattr(result, \"email\", None))\n        user_id: str | None = getattr(result, \"id\", None) if result is not None else None\n        user_role: str | None = None\n\n        if user_email is not None and os.getenv(\"ALLOWED_EMAIL_DOMAINS\") is not None:\n            email_domain: Final = user_email.split(\"@\")[1]\n            allowed_domains: Final = os.getenv(\"ALLOWED_EMAIL_DOMAINS\").split(\",\")\n            if email_domain not in allowed_domains:\n                raise HTTPException(\n                    status_code=401,\n                    detail={\n                        \"message\": f\"The email domain={email_domain}, is not an allowed email domain={allowed_domains}. Contact your admin to change this.\"\n                    },\n                )\n\n        # Extract user_role from result (works for all SSO providers)\n        if result is not None:\n            _user_role: Final = getattr(result, \"user_role\", None)\n            if _user_role is not None:\n                # Convert enum to string if needed\n                user_role = _user_role.value if isinstance(_user_role, LitellmUserRoles) else _user_role\n                verbose_proxy_logger.debug(\"Extracted user_role from SSO result: %s\", user_role)\n\n        # generic client id - override with custom attribute name if specified\n        if generic_client_id is not None and result is not None:\n            generic_user_role_attribute_name: Final = os.getenv(\"GENERIC_USER_ROLE_ATTRIBUTE\", \"role\")\n            user_id = getattr(result, \"id\", None)","sourceCodeStart":3382,"sourceCodeEnd":3418,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/ui_sso.py#L3382-L3418","documentation":"Error \"The email domain={email_domain}, is not an allowed email domain={allowed_domains}. Contact your admin to change this.\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/ui_sso.py:3400 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Sign in with an allowed email domain, or ask the admin to add the domain to the allowed domains list."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}