[Bug]: Generic SSO handler should be decoding the id_token, not the access_token.

[echupkin]

What happened?

When Authenticating via generic SSO I receive the following error:
LiteLLM Proxy:ERROR: ui_sso.py:391 - Error verifying and processing generic SSO: Not enough segments. Passed in headers: {}
While SSO worked in the previous versions, it's now failing to authenticate with a "500 Internal Server Error"

After further investigation I noticed that it's trying to it's trying to decode access_token instead of id_token.

Further investigation revealed the block of code in litellm/proxy/management_endpoints/ui_sso.py around line 98 is what's causing the problem.

Relevant log output

LiteLLM Proxy:ERROR: ui_sso.py:391 - Error verifying and processing generic SSO: Not enough segments. Passed in headers: {}
Traceback (most recent call last):
  File "/usr/lib/python3.13/site-packages/jwt/api_jws.py", line 258, in _load
    signing_input, crypto_segment = jwt.rsplit(b".", 1)
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: not enough values to unpack (expected 2, got 1)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/usr/lib/python3.13/site-packages/litellm/proxy/management_endpoints/ui_sso.py", line 388, in get_generic_sso_response
    "GENERIC_SSO_HEADERS", None
  File "/usr/lib/python3.13/site-packages/litellm/proxy/management_endpoints/ui_sso.py", line 99, in process_sso_jwt_access_token
    access_token_payload = jwt.decode(
                       ^^^^^^^^^^^^^^^
        access_token_str, options={"verify_signature": False}
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )

  File "/usr/lib/python3.13/site-packages/jwt/api_jwt.py", line 211, in decode
    decoded = self.decode_complete(
        jwt,
    ...<7 lines>...
        leeway=leeway,
    )
  File "/usr/lib/python3.13/site-packages/jwt/api_jwt.py", line 152, in decode_complete
    decoded = api_jws.decode_complete(
        jwt,
    ...<3 lines>...
        detached_payload=detached_payload,
    )
  File "/usr/lib/python3.13/site-packages/jwt/api_jws.py", line 199, in decode_complete
    payload, signing_input, header, signature = self._load(jwt)
                                                ~~~~~~~~~~^^^^^
  File "/usr/lib/python3.13/site-packages/jwt/api_jws.py", line 261, in _load
    raise DecodeError("Not enough segments") from err
jwt.exceptions.DecodeError: Not enough segments
INFO:     192.168.1.50:58386 - "GET /sso/callback?code=ry48rsiCIRKEwEvHKA9LIDcCIi5qAC3H HTTP/1.1" 500 Internal Server Error
ERROR:    Exception in ASGI application
Traceback (most recent call last):
  File "/usr/lib/python3.13/site-packages/jwt/api_jws.py", line 258, in _load
    signing_input, crypto_segment = jwt.rsplit(b".", 1)
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: not enough values to unpack (expected 2, got 1)

Are you a ML Ops Team?

No

What LiteLLM version are you on ?

v1.77.5.rc.4

Twitter / LinkedIn details

No response

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.