feat(oidc): make OIDC GetIdentifier claim configurable

[geonux]

---

name: Pull request
about: Pull request for this project
title: feat(oidc): make OIDC identifier claim configurable
labels: oidc, sub, user_isolation
assignees: ""

Issue/Feature

This PR introduces support for configuring which OIDC claim is used to build the authenticated user identifier returned by GetIdentifier().

Previously, identifier behavior was tied to user-facing fields (historically preferred_username with fallback to email). This was not always appropriate for all identity providers and use cases.

Additional Information

What changed

• Added a configurable OIDC identifier claim (uidClaim) in OIDC auth provider configuration.
• Updated OIDC authentication flow to compute and store Uid from the configured claim.
• Kept backward-compatible behavior when the default claim is used:
  • if preferred_username exists, it is used
  • otherwise fallback to email
• Updated model behavior so GetIdentifier() in OIDC context returns the computed Uid.
• Added/updated unit tests to validate UID construction and fallback logic.

Note : also a little correction on the MakeFile because of a signature error when unpacking golangci-lint.

Why

We do not always want to rely on email or preferred_username because these are user-facing attributes that may change.
For identity-sensitive logic, a stable and unique value (for example sub or another immutable claim) is often required.

Making GetIdentifier() configurable in OIDC context improves:

• identity consistency over time
• portability across IdPs with different claim strategies (or using LDAP backend)
• predictability for authorization and business logic

How this helps functional behavior :

• User isolation: object path/key scoping based on GetIdentifier() becomes safer and more stable when backed by an immutable claim.
• Templates: template context that depends on the authenticated identifier can now reflect the configured identity strategy, instead of being implicitly tied to mutable profile fields.

Verification Steps

1. Configure an OIDC provider with uidClaim: preferred_username.
2. Authenticate a user with preferred_username present.
3. Confirm GetIdentifier() resolves to preferred_username.
4. Authenticate a user where preferred_username is missing.
5. Confirm fallback to email still occurs.
7. Configure uidClaim: sub (or another custom claim present in token claims).
8. Authenticate again and confirm GetIdentifier() resolves to that custom claim value.
9. Verify user-isolation behavior still works as expected (path/key namespace based on identifier).
10. Verify templates using user identifier display/use the configured UID strategy.
11. Run unit tests and lint checks to confirm no regression.

Checklist:

• Verified by team member
• Tests were added
• Comments where necessary
• Documentation changes if necessary