Allow passed in vertex_ai credentials to be authorized_user type

litellm/llms/vertex_ai/vertex_llm_base.py

@@ -42,13 +42,11 @@ def load_auth(
     ) -> Tuple[Any, str]:
         import google.auth as google_auth
         from google.auth import identity_pool
-        from google.auth.transport.requests import (
-            Request,  # type: ignore[import-untyped]
-        )
 
         if credentials is not None:
             import google.oauth2.service_account
-
+            import google.oauth2.credentials as google_oauth_credentials
+
             if isinstance(credentials, str):
                 verbose_logger.debug(
                     "Vertex: Loading vertex credentials from %s", credentials
@@ -81,6 +79,14 @@ def load_auth(
             # Check if the JSON object contains Workload Identity Federation configuration
             if "type" in json_obj and json_obj["type"] == "external_account":
                 creds = identity_pool.Credentials.from_info(json_obj)
+            # Check if the JSON object contains Authorized User configuration (via gcloud auth application-default login)
+            elif "type" in json_obj and json_obj["type"] == "authorized_user":
+                creds = google_oauth_credentials.Credentials.from_authorized_user_info(
+                    json_obj,
+                    scopes=["https://www.googleapis.com/auth/cloud-platform"],
+                )
+                if project_id is None:
+                    project_id = creds.quota_project_id # authorized user credentials don't have a project_id, only quota_project_id
             else:
                 creds = (
                     google.oauth2.service_account.Credentials.from_service_account_info(
@@ -99,7 +105,7 @@ def load_auth(
             if project_id is None:
                 project_id = creds_project_id
 
-        creds.refresh(Request())  # type: ignore
+        self.refresh_auth(creds)
 
         if not project_id:
             raise ValueError("Could not resolve project_id")

tests/litellm/llms/vertex_ai/test_vertex_llm_base.py

@@ -174,3 +174,53 @@ async def test_gemini_credentials(self, is_async):
             )
         assert token == ""
         assert project == ""
+
+
+    @pytest.mark.parametrize("is_async", [True, False], ids=["async", "sync"])
+    @pytest.mark.asyncio
+    async def test_authorized_user_credentials(self, is_async):
+        vertex_base = VertexBase()
+
+        credentials = {
+            "account": "",
+            "client_id": "fake-client-id",
+            "client_secret": "fake-secret",
+            "quota_project_id": "test-project",
+            "refresh_token": "fake-refresh-token",
+            "type": "authorized_user",
+            "universe_domain": "googleapis.com"
+        }
+
+        with patch.object(vertex_base, "refresh_auth") as mock_refresh:
+            def mock_refresh_impl(creds):
+                creds.token = "refreshed-token"
+
+            mock_refresh.side_effect = mock_refresh_impl
+
+            # 1. Test that authorized_user-style credentials are correctly handled and uses quota_project_id
+            if is_async:
+                token, project = await vertex_base._ensure_access_token_async(
+                    credentials=credentials, project_id=None, custom_llm_provider="vertex_ai"
+                )
+            else:
+                token, project = vertex_base._ensure_access_token(
+                    credentials=credentials, project_id=None, custom_llm_provider="vertex_ai"
+                )
+
+
+            assert token == "refreshed-token"
+            assert project == "test-project"
+
+            # 1. Test that authorized_user-style credentials are correctly handled and uses passed in project_id
+            if is_async:
+                token, project = await vertex_base._ensure_access_token_async(
+                    credentials=credentials, project_id="new-project", custom_llm_provider="vertex_ai"
+                )
+            else:
+                token, project = vertex_base._ensure_access_token(
+                    credentials=credentials, project_id="new-project", custom_llm_provider="vertex_ai"
+                )
+
+
+            assert token == "refreshed-token"
+            assert project == "new-project"