Make changes to openid_connect uid field (#5523)

* Make changes to openid_connect uid field

* Clean up

.rubocop.yml

@@ -70,7 +70,7 @@ Metrics/ClassLength:
 # A calculated magnitude based on number of assignments,
 # branches, and conditions.
 Metrics/AbcSize:
-  Max: 65
+  Max: 75
 
 Metrics/ParameterLists:
   CountKeywordArgs: false
@@ -82,7 +82,7 @@ Metrics/CyclomaticComplexity:
   Max: 16
 
 Metrics/PerceivedComplexity:
-  Max: 15
+  Max: 17
 
 Rails/Exit:
   Exclude:

app/controllers/api/v1/migrations/external_controller.rb

@@ -16,8 +16,6 @@
 
 # frozen_string_literal: true
 
-# rubocop:disable Metrics/PerceivedComplexity
-
 module Api
   module V1
     module Migrations
@@ -276,4 +274,3 @@ def generate_secure_pwd
     end
   end
 end
-# rubocop:enable Metrics/PerceivedComplexity

app/controllers/external_controller.rb

@@ -30,7 +30,15 @@ def create_user
 
     user_info = build_user_info(credentials)
 
-    user = User.find_by(external_id: credentials['uid'], provider:) || User.find_by(email: credentials['info']['email'], provider:)
+    user = User.find_by(external_id: credentials['uid'], provider:)
+
+    # Fallback mechanism to search by email
+    if user.blank?
+      user = User.find_by(email: credentials['info']['email'], provider:)
+      # Update the user's external id to the latest value to avoid using the fallback
+      user.update(external_id: credentials['uid']) if user.present? && credentials['uid'].present?
+    end
+
     new_user = user.blank?
 
     registration_method = SettingGetter.new(setting_name: 'RegistrationMethod', provider: current_provider).call

config/initializers/omniauth.rb

@@ -29,7 +29,7 @@
 
       env['omniauth.strategy'].options[:issuer] = issuer_url
       env['omniauth.strategy'].options[:scope] = %i[openid email profile]
-      env['omniauth.strategy'].options[:uid_field] = ENV.fetch('OPENID_CONNECT_UID_FIELD', 'preferred_username')
+      env['omniauth.strategy'].options[:uid_field] = ENV.fetch('OPENID_CONNECT_UID_FIELD', 'sub')
       env['omniauth.strategy'].options[:discovery] = true
       env['omniauth.strategy'].options[:client_options].identifier = ENV.fetch('OPENID_CONNECT_CLIENT_ID')
       env['omniauth.strategy'].options[:client_options].secret = secret
@@ -46,7 +46,7 @@
     provider :openid_connect,
              issuer:,
              scope: %i[openid email profile],
-             uid_field: ENV.fetch('OPENID_CONNECT_UID_FIELD', 'preferred_username'),
+             uid_field: ENV.fetch('OPENID_CONNECT_UID_FIELD', 'sub'),
              discovery: true,
              client_options: {
                identifier: ENV.fetch('OPENID_CONNECT_CLIENT_ID'),

sample.env

@@ -44,6 +44,7 @@ REDIS_URL=
 #OPENID_CONNECT_CLIENT_SECRET=
 #OPENID_CONNECT_ISSUER=
 #OPENID_CONNECT_REDIRECT=
+#OPENID_CONNECT_UID_FIELD=
 
 # To enable hCaptcha on the user sign up and sign in, define these 2 keys
 #HCAPTCHA_SITE_KEY=