From 2b091832d05ff35362946b0382963cbc729cd2d0 Mon Sep 17 00:00:00 2001
From: Philipp Fruck <dev@p-fruck.de>
Date: Mon, 19 Jan 2026 21:49:48 +0100
Subject: [PATCH] fix(auth): Use correct data for SSO group sync (#11164)

https://docs.allauth.org/en/latest/release-notes/recent.html#id18
Since django-allauth 65.11.0 (InvenTree v1.1.X), the extra_data
is divided into separate userinfo and id_token objects
---
 src/backend/InvenTree/InvenTree/sso.py       | 4 +++-
 src/backend/InvenTree/InvenTree/test_auth.py | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/backend/InvenTree/InvenTree/sso.py b/src/backend/InvenTree/InvenTree/sso.py
index cbb2d79938..891708f73f 100644
--- a/src/backend/InvenTree/InvenTree/sso.py
+++ b/src/backend/InvenTree/InvenTree/sso.py
@@ -96,7 +96,9 @@ def ensure_sso_groups(sender, sociallogin: SocialLogin, **kwargs):
     group_map = json.loads(get_global_setting('SSO_GROUP_MAP'))
     # map SSO groups to InvenTree groups
     group_names = []
-    for sso_group in sociallogin.account.extra_data.get(group_key, []):
+    for sso_group in sociallogin.account.extra_data.get('userinfo', {}).get(
+        group_key, []
+    ):
         if mapped_name := group_map.get(sso_group):
             group_names.append(mapped_name)
 
diff --git a/src/backend/InvenTree/InvenTree/test_auth.py b/src/backend/InvenTree/InvenTree/test_auth.py
index c8651c4285..465be13b64 100644
--- a/src/backend/InvenTree/InvenTree/test_auth.py
+++ b/src/backend/InvenTree/InvenTree/test_auth.py
@@ -38,7 +38,7 @@ class TestSsoGroupSync(TransactionTestCase):
             'SSO_GROUP_MAP', '{"idp_group": "inventree_group"}'
         )
         # configure sociallogin
-        extra_data = {'groups': ['idp_group']}
+        extra_data = {'userinfo': {'groups': ['idp_group']}}
         self.group = Group(name='inventree_group')
         self.group.save()
         # ensure default group exists