external_id is now the subject, preferred_username is now defined per…

… OIDC spec

auth/auth.go

@@ -127,19 +127,19 @@ func (o *OIDCProvider) newSession(aroot string, values url.Values) *openid.Defau
 	return &openid.DefaultSession{
 		Claims: &jwt.IDTokenClaims{
 			Issuer:      aroot,
-			Subject:     values.Get("username"),
+			Subject:     values.Get("external_id"),
 			Audience:    []string{},
 			ExpiresAt:   time.Now().Add(time.Hour * 6),
 			IssuedAt:    time.Now(),
 			RequestedAt: time.Now(),
 			AuthTime:    time.Now(),
 			Extra: map[string]interface{}{
-				"email":          values.Get("email"),
-				"email_verified": true,
-				"picture":        values.Get("avatar_url"),
-				"name":           values.Get("name"),
-				"groups":         strings.Split(values.Get("groups"), ","),
-				"external_id":    values.Get("external_id"),
+				"email":              values.Get("email"),
+				"email_verified":     true,
+				"picture":            values.Get("avatar_url"),
+				"name":               values.Get("name"),
+				"groups":             strings.Split(values.Get("groups"), ","),
+				"preferred_username": values.Get("username"),
 			},
 		},
 		Headers: &jwt.Headers{