diff --git a/app/models/discourse_single_sign_on.rb b/app/models/discourse_single_sign_on.rb
index 40eacadbb69..0816a55b485 100644
--- a/app/models/discourse_single_sign_on.rb
+++ b/app/models/discourse_single_sign_on.rb
@@ -114,7 +114,11 @@ class DiscourseSingleSignOn < SingleSignOn
       .where('group_id IN (SELECT id FROM groups WHERE NOT automatic)')
       .where(user_id: user.id)
 
-    group_users.where('group_id NOT IN (?)', ids).destroy_all
+    delete_group_users = group_users
+    if ids.length > 0
+      delete_group_users = group_users.where('group_id NOT IN (?)', ids)
+    end
+    delete_group_users.destroy_all
 
     ids -= group_users.where('group_id IN (?)', ids).pluck(:group_id)
 
diff --git a/spec/models/discourse_single_sign_on_spec.rb b/spec/models/discourse_single_sign_on_spec.rb
index 373c2518d2c..ff22598ebe1 100644
--- a/spec/models/discourse_single_sign_on_spec.rb
+++ b/spec/models/discourse_single_sign_on_spec.rb
@@ -147,6 +147,11 @@ describe DiscourseSingleSignOn do
     sso.lookup_or_create_user(ip_address)
     expect(group1.usernames).to eq("")
     expect(group2.usernames).to eq(user.username)
+
+    sso.groups = "badname,trust_level_4"
+    sso.lookup_or_create_user(ip_address)
+    expect(group1.usernames).to eq("")
+    expect(group2.usernames).to eq("")
   end
 
   it "can specify groups" do