Admin UI - Set a limited list in the models field of a user

[ishaan-jaff]

Problem

Prevent user from creating key for a model that is not allowed to them

cc: @Lunik

[krrishdholakia]

Thinking

We could do something similar to what we did for keys:

litellm_settings:
  default_user_params:
    modes: ["gpt-3.5-turbo"] # default model everyone has access to 

[krrishdholakia]

When is a new user written to our db?

• Our sso logic assumes a user already exists when they login, this isn't always true. This means when a user logs in via /sso/callback we should be doing an upsert operation to make sure they exist in the litellm db.

[krrishdholakia]

Documenting issues.

Created a user on keycloak.

I'm logged in as app owner, but I can see all models on proxy:

[krrishdholakia]

Seeing hashed token issue that @Lunik saw

[ishaan-jaff]

I'm logged in as app owner, but I can see all models on proxy:

This is intentional - you should be able to see all models, even ones you don't have access to. IMO App owners should be able to request models they don't have access to

[krrishdholakia]

@ishaan-jaff agreed you should see what's available, but it says i have access to all models

[krrishdholakia]

fixed call issue

[krrishdholakia]

Issue 1:

new user unable to create keys

[krrishdholakia]

Issue 2:

new user (not even in proxy db) is able to see all models while creating a key

[krrishdholakia]

Looks like the dropdown calls /model/info

I think this would be solved by just calling the /models endpoint - it's written to just return models the user has access to

[krrishdholakia]

Just pushed fixes for

• model dropdown for create key
• Chat Ui

We now support a default_user_params as a litellm setting, so you can do

litellm_settings: 
      default_user_params: 
          models: ["gemini-pro"] 

and all new SSO users will just have access to gemini-pro

[krrishdholakia]

this is now live