Enhancement: Ability to use the "sub" claim from OpenID for the username

[alihacks]

What features would you like to see added?

Currently, the username field is populated from "username", "given_name" or "email" fields - in that order. I would like to populate this from the "sub" claim. I would like to either support that in code or introduce new environment variable OPENID_USERNAME_CLAIM or similar to allow the user to configure this

More details

n/a

Which components are impacted by your request?

No response

Pictures

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

isn't sub usually an ID? a new environment variable would be appreciated. I would like to write some tests first to test the existing behavior, or if you want to take a shot at that as well.

[alihacks]

In our case, sub is the username. We're using Shibooleth Open ID Connect as the IdP.

It looks like username is not a standard field, this is why we do not have it in our environment: https://openid.net/specs/openid-connect-basic-1_0.html#StandardClaims

[alihacks]

Sent a PR #4248 for the claims discussions. Please take a look. As for documentation, there isn't a "generic" OIDC page, should I add these vars under the keycloak page (which I used in my case)?