v0.1.1

Fixed

• Import NetBox's own users.models.Group, not django.contrib.auth.models.Group. NetBox 4.x replaces Django's stock auth Group entirely with its own model (separate table; User.groups points there) — importing the wrong one produced TypeError: Field 'id' expected a number but got <Group: ...> at real login time.
• Drop the is_staff assignment — NetBox's User model has no such field, so it was a silent no-op.

Testing

Added testapp/users/, a stand-in mirroring NetBox's actual Group/User shape, so the test suite now exercises the real import path this bug was in.

Full Changelog: v0.1.0...v0.1.1

v0.1.0

Initial release

netbox-oidc-group-sync closes a gap in NetBox Community's OIDC login flow: when logging in via
social_core.backends.open_id_connect.OpenIdConnectAuth (or another social-auth OIDC backend), NetBox's
REMOTE_AUTH_GROUP_SYNC_ENABLED / AUTO_CREATE_GROUPS / SUPERUSER_GROUPS settings are silently ignored —
those are only consumed by the HTTP-header remote-auth path (RemoteUserBackend.configure_groups()), which
OIDC logins never reach. The pipeline step actually wired into SOCIAL_AUTH_PIPELINE for social-auth
backends only assigns a static group list and never touches is_superuser.

sync_groups is a drop-in replacement for that pipeline step. Dropped into SOCIAL_AUTH_PIPELINE in place
of user_default_groups_handler, it re-implements configure_groups()'s dynamic, claim-based logic against
the OIDC response instead of an HTTP header — reading NetBox's existing REMOTE_AUTH_* settings, so there's
no new configuration surface to learn.

Added

• sync_groups pipeline step: syncs Django groups from an OIDC groups claim, with optional auto-creation
  of missing groups (REMOTE_AUTH_AUTO_CREATE_GROUPS) and superuser/staff evaluation against
  REMOTE_AUTH_SUPERUSER_GROUPS (REMOTE_AUTH_STAFF_GROUPS).
• Full type annotations (py.typed) for downstream mypy consumers.
• Documentation site (Installation, Configuration) built with Zensical and published via GitHub Pages.

Requirements

• Python 3.12+
• Django 4.2+
• social-auth-core 4.5+

Project infrastructure

• CI: lint (ruff, mypy, rumdl) and test (Python 3.12/3.13, 100% coverage gate) workflows on every PR.
• Release: PyPI publishing via Trusted Publishing on tagged
  GitHub releases.
• Branch protection on main: required status checks, squash-only merges, linear history.

Full installation and configuration reference: see the README
and documentation site.