Provide OIDC nickname/preferred_username claims in id_token
The OIDC feature provides a lot of information as documented in https://docs.gitlab.com/ee/integration/openid_connect_provider.html#shared-information.
I tried to use this with an external application and discovered that it's a bit inconsistent, what information is shared where. All information is shared in the UserInfo (https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse) but only a fraction in the Id-Token (https://openid.net/specs/openid-connect-core-1_0.html#IDToken). While this is completely fine with the standard, it is off, that specific data like the direct group membership is shared in the ID-Token but more general data like the username (nickname & preferred_username) is only available via the UserInfo. This forces every integration which uses GitLab as an OIDC provider to make at least two requests to GitLab on login to fetch the actual username.
The code responsible for this is in https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/doorkeeper_openid_connect.rb#L35. The behavior of the used library is documented in its README:
By default all custom claims are only returned from the UserInfo endpoint and not included in the ID token. You can optionally pass a response: keyword with one or both of the symbols :id_token or :user_info to specify where the claim should be returned.
Please consider populating the ID-Token with the username (as preferred_username and/or nickname claim) as well.