diff --git a/app/models/discourse_single_sign_on.rb b/app/models/discourse_single_sign_on.rb
index c910994fc2c..97a75c312e9 100644
--- a/app/models/discourse_single_sign_on.rb
+++ b/app/models/discourse_single_sign_on.rb
@@ -60,10 +60,7 @@ class DiscourseSingleSignOn < SingleSignOn
     user.unstage
     user.save
 
-    # if the user isn't new or it's attached to the SSO record we might be overriding username or email
-    unless user.new_record?
-      change_external_attributes_and_override(sso_record, user)
-    end
+    change_external_attributes_and_override(sso_record, user)
 
     if sso_record && (user = sso_record.user) && !user.active && !require_activation
       user.active = true
@@ -176,6 +173,10 @@ class DiscourseSingleSignOn < SingleSignOn
           ip_address: ip_address
         }
 
+        if SiteSetting.allow_user_locale && locale && LocaleSiteSetting.valid_value?(locale)
+          user_params[:locale] = locale
+        end
+
         user = User.create!(user_params)
 
         if SiteSetting.verbose_sso_logging
@@ -247,6 +248,10 @@ class DiscourseSingleSignOn < SingleSignOn
       user.name = name || User.suggest_name(username.blank? ? email : username)
     end
 
+    if locale_force_update && SiteSetting.allow_user_locale && locale && LocaleSiteSetting.valid_value?(locale)
+      user.locale = locale
+    end
+
     avatar_missing = user.uploaded_avatar_id.nil? || !Upload.exists?(user.uploaded_avatar_id)
 
     if (avatar_missing || avatar_force_update || SiteSetting.sso_overrides_avatar) && avatar_url.present?
diff --git a/lib/single_sign_on.rb b/lib/single_sign_on.rb
index 9f1c475f4c6..6900b633b2b 100644
--- a/lib/single_sign_on.rb
+++ b/lib/single_sign_on.rb
@@ -1,9 +1,40 @@
 class SingleSignOn
-  ACCESSORS = [:nonce, :name, :username, :email, :avatar_url, :avatar_force_update, :require_activation,
-               :bio, :external_id, :return_sso_url, :admin, :moderator, :suppress_welcome_message, :title,
-               :add_groups, :remove_groups, :groups, :profile_background_url, :card_background_url, :website]
+
+  ACCESSORS = %i{
+    add_groups
+    admin moderator
+    avatar_force_update
+    avatar_url
+    bio
+    card_background_url
+    email
+    external_id
+    groups
+    locale
+    locale_force_update
+    name
+    nonce
+    profile_background_url
+    remove_groups
+    require_activation
+    return_sso_url
+    suppress_welcome_message
+    title
+    username
+    website
+  }
+
   FIXNUMS = []
-  BOOLS = [:avatar_force_update, :admin, :moderator, :require_activation, :suppress_welcome_message]
+
+  BOOLS = %i{
+    admin
+    avatar_force_update
+    locale_force_update
+    moderator
+    require_activation
+    suppress_welcome_message
+  }
+
   NONCE_EXPIRY_TIME = 10.minutes
 
   attr_accessor(*ACCESSORS)
diff --git a/spec/models/discourse_single_sign_on_spec.rb b/spec/models/discourse_single_sign_on_spec.rb
index 950bf944359..52b26a3a768 100644
--- a/spec/models/discourse_single_sign_on_spec.rb
+++ b/spec/models/discourse_single_sign_on_spec.rb
@@ -327,6 +327,36 @@ describe DiscourseSingleSignOn do
     expect(sso.nonce).to_not be_nil
   end
 
+  context 'user locale' do
+    it 'sets default user locale if specified' do
+      SiteSetting.allow_user_locale = true
+
+      sso = DiscourseSingleSignOn.new
+      sso.username = "test"
+      sso.name = "test"
+      sso.email = "test@test.com"
+      sso.external_id = "123"
+      sso.locale = "es"
+
+      user = sso.lookup_or_create_user(ip_address)
+
+      expect(user.locale).to eq("es")
+
+      user.update_column(:locale, "he")
+
+      user = sso.lookup_or_create_user(ip_address)
+      expect(user.locale).to eq("he")
+
+      sso.locale_force_update = true
+      user = sso.lookup_or_create_user(ip_address)
+      expect(user.locale).to eq("es")
+
+      sso.locale = "fake"
+      user = sso.lookup_or_create_user(ip_address)
+      expect(user.locale).to eq("es")
+    end
+  end
+
   context 'trusting emails' do
     let(:sso) do
       sso = DiscourseSingleSignOn.new