fix: resolve nested CustomOpenID extra_fields in CLI SSO claim extraction

cursoragent · yassin-berriai · cursoragent · commit a0ecb87fdae9 · 2026-05-21T17:51:16.000Z
When GENERIC_USER_EXTRA_ATTRIBUTES captures a parent object (e.g. org_info),
extra_fields stores it as {"org_info": {"department": "..."}}. A CLI claim
map entry using a dotted path like org_info.department would silently fail
because the lookup only checked the exact flat key. Fall back to dotted-path
resolution on extra_fields before model_dump().

Co-authored-by: Yassin Kortam &lt;yassin@berri.ai&gt;
diff --git a/litellm/proxy/management_endpoints/ui_sso.py b/litellm/proxy/management_endpoints/ui_sso.py
@@ -325,8 +325,12 @@ def _extract_sso_claim_value(
     result: Union[CustomOpenID, OpenID, dict], claim_path: str
 ) -> Any:
     extra_fields = getattr(result, "extra_fields", None)
-    if isinstance(extra_fields, dict) and claim_path in extra_fields:
-        return extra_fields[claim_path]
+    if isinstance(extra_fields, dict):
+        if claim_path in extra_fields:
+            return extra_fields[claim_path]
+        nested = _get_nested_claim_value(extra_fields, claim_path)
+        if nested is not None:
+            return nested
 
     if isinstance(result, dict):
         return _get_nested_claim_value(result, claim_path)
