Feature: Support using different claim than email address as username

[adombeck]

It was requested in #574 (comment) to support using a different claim than the email address as the username:

Our email address is on the format firstname.middlename.lastname@domain.com, which makes at least for some of us the username in ubuntu very long, even if we remove the domain part.

It would be nice if we could map our actual username in keycloak to a claim and send it to authd so we get the same username in ubuntu as we use in the rest of the organization.

[adombeck]

It would be nice if we could map our actual username in keycloak to a claim

@cogliostro how do you do create such a custom claim in keycloak?

[cogliostro]

In Keycloak, you can add a custom claim to the ID token using a Protocol Mapper on the client (or a client scope). For the username specifically:

1. Go to Clients > your client > Client scopes tab
2. Click the dedicated scope (e.g. -dedicated)
3. Click Add mapper > By configuration > User Property
4. Configure it:
   • Name: username (or whatever you like)
   • Property: username
   • Token Claim Name: username (this is the claim name that will appear in the ID token)
   • Claim JSON Type: String
   • Add to ID token: ON
   • Add to access token: ON (optional)
   • Add to userinfo: ON (optional)
5. Save

you can verify this under Client Scopes -> Evaluate. Select a user and look at Generated ID Token.

[adombeck]

Thanks a lot @cogliostro! I was able to create a custom claim using your instructions. I noticed that it's not necessary to add a custom claim for the Keycloak username though. The username is by default mapped to the preferred_username claim in the ID token, which is an OIDC standard claim. The standard does not require that claim to be unique, but Keycloak seems to ensure that the username is unique, so it should be fine to use as the authd username.

There are a few things to consider though before adding a username_claim setting, like what happens to existing authd users if the setting is changed. So this needs some design first. We'll see how we can prioritize this.

[shiv-tyagi]

Perhaps we can introduce two settings in broker.conf, username_claim and shorten_usernames.

The username can then be determined as follows:

if username_claim is set:
    username = username_claim.value
else if shorten_usernames:
    username = email.split('@')[0]
else:
    username = email

The user is still identified internally using a UID. The new username determined through the above logic can be treated as a rename operation (if it doesn't match the existing username) and acted upon accordingly.
That way we can always identify a user uniquely but still be able to support changing usernames for users based on the above settings.