Store and use the OIDC sub claim as primary account identifier

T. Andrew Manningrequested to merge
67-use-oidc-sub-claim into main

Instead of relying on the email address to associate the Django account with other MUSES service accounts (that all use the same OIDC identity broker/provider), store the OIDC "sub" claim in a new Profile model linked to the Django User model, and use this value when querying the Discourse API to fetch user information including the group memberships that authorize CE usage.

Note: There may be isolated cases for existing users that require manual intervention by the admin. For example, if the email associated with their IdP does not match their primary Discourse email, and admin will need to determine the UUID from the central identity broker (e.g. Keycloak) and then manually enter it as the Profile "sub" value via the Django admin interface.

Resolves #67 (closed).

Edited by T. Andrew Manning

Merge request reports