Add support for extra fields in Generic SSO via GENERIC_USER_EXTRA_ATTRIBUTES

[Praveena-617]

Enables extraction of additional fields from the Generic SSO userinfo endpoint response beyond the standard 8 fields (id, email, name, etc.). Custom handlers can now access these fields via CustomOpenID.extra_fields dict.

Changes:

• Add extra_fields: Optional[Dict[str, Any]] to CustomOpenID type

• Add GENERIC_USER_EXTRA_ATTRIBUTES env var (comma-separated field names)

• Extract specified fields using get_nested_value() with dot notation support

• Add 4 test cases covering basic, nested, and missing field scenarios

• Update custom_sso.py example showing how to access extra_fields

Backward compatible: extra_fields is None when env var not set

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Feb 9, 2026 4:03pm

[greptile-apps]

Greptile Overview

Greptile Summary

Added support for extracting custom fields from Generic SSO userinfo responses via the GENERIC_USER_EXTRA_ATTRIBUTES environment variable. This extends the existing SSO flow to capture additional identity provider fields beyond the standard 8 fields (id, email, name, etc.).

Key Changes:

• Added extra_fields: Optional[Dict[str, Any]] to CustomOpenID type for storing additional SSO fields
• Implemented extraction logic in generic_response_convertor() that reads GENERIC_USER_EXTRA_ATTRIBUTES env var (comma-separated field names)
• Uses existing get_nested_value() utility to support dot notation for nested fields (e.g., org_info.department)
• Maintains backward compatibility: extra_fields is None when env var not set
• Updated example in custom_sso.py showing how custom handlers can access extra_fields via userIDPInfo.extra_fields
• Comprehensive test coverage with 4 test cases covering basic extraction, nested paths, missing fields, and backward compatibility

Implementation Quality:

• Leverages existing get_nested_value() function which already handles nested paths and returns None for missing fields
• Called only during SSO login flow, not in critical request path (performance custom rule does not apply)
• Clean integration with existing SSO architecture
• Well-tested with multiple edge cases

Confidence Score: 5/5

• Safe to merge with no identified issues
• The implementation is clean, well-tested, and backward compatible. Uses existing utilities (get_nested_value()) for robust field extraction with dot notation support. Called only during SSO login (not critical request path), so performance concerns don't apply. Comprehensive test coverage validates basic extraction, nested paths, missing fields, and backward compatibility. Changes follow existing code patterns and maintain the optional nature of the feature.
• No files require special attention

Important Files Changed

Filename	Overview
litellm/proxy/management_endpoints/types.py	Added optional extra_fields dict to CustomOpenID class for storing additional SSO fields
litellm/proxy/management_endpoints/ui_sso.py	Implemented extraction of extra SSO fields via GENERIC_USER_EXTRA_ATTRIBUTES env var using get_nested_value()
litellm/proxy/custom_sso.py	Added example comments showing how to access extra_fields from userIDPInfo in custom SSO handler
tests/test_litellm/proxy/management_endpoints/test_ui_sso.py	Added 4 test cases covering basic extraction, nested paths, missing fields, and backward compatibility

Sequence Diagram

sequenceDiagram
    participant User
    participant LiteLLM as LiteLLM Proxy
    participant SSO as SSO Provider
    participant Convertor as generic_response_convertor
    participant Handler as custom_sso_handler
    
    User->>LiteLLM: Login via SSO
    LiteLLM->>SSO: Redirect to SSO Provider
    SSO->>SSO: User authenticates
    SSO->>LiteLLM: Return userinfo response
    Note over LiteLLM: Contains standard fields<br/>(id, email, name, etc.)<br/>+ custom fields
    
    LiteLLM->>Convertor: Process SSO response
    Note over Convertor: Check GENERIC_USER_EXTRA_ATTRIBUTES
    
    alt GENERIC_USER_EXTRA_ATTRIBUTES is set
        Convertor->>Convertor: Parse comma-separated field names
        loop For each extra attribute
            Convertor->>Convertor: get_nested_value(response, attr_name)
            Note over Convertor: Supports dot notation<br/>(e.g., "org_info.department")
        end
        Convertor->>Convertor: Build extra_fields dict
    else GENERIC_USER_EXTRA_ATTRIBUTES not set
        Convertor->>Convertor: Set extra_fields = None
    end
    
    Convertor->>LiteLLM: Return CustomOpenID with extra_fields
    LiteLLM->>Handler: Call custom_sso_handler(userIDPInfo)
    Note over Handler: Can access extra_fields<br/>via userIDPInfo.extra_fields
    Handler->>Handler: Process user (create/update)
    Handler->>LiteLLM: Return SSOUserDefinedValues
    LiteLLM->>User: Redirect to UI with JWT

Loading

[greptile-apps]

_{4 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}