Skip to content

0056. Disable Enterprise-gated SSO and Use Built-in Admin Login

  • Status: proposed (auto-drafted by adr-suggester)
  • Date: 2026-07-27
  • Deciders: lusoris
  • Related: PR #3206

Context

The LiteLLM admin UI is 403-ing the operator due to enterprise-gated SSO restrictions. The current setup requires a paid license for SSO beyond 5 users, which is not feasible for the current setup. The PR disables SSO and switches to the built-in admin login, which uses the existing master key secret.

Decision

Disable SSO by setting sso.enabled: false and remove all SSO-related environment variables, including GENERIC_CLIENT_ID, GENERIC_CLIENT_SECRET, PROXY_BASE_URL, and AUTO_REDIRECT_UI_LOGIN_TO_SSO. This change ensures the admin login uses the built-in login form with the existing master key secret, avoiding enterprise-gated SSO issues.

Alternatives considered

TBD — fill in before flipping Status to Accepted.

Consequences

TBD — fill in before flipping Status to Accepted.

References

  • PR #3206 — fix(litellm): disable Enterprise-gated SSO, use built-in admin login