🛂(backend) match email if no existing user matches the sub

[sampaccoud]

Purpose

Some OIDC identity providers may provide a random value in the "sub" field instead of an identifying ID. In this case, it may be a good idea to fallback to matching the user on its email field.

Proposal

• Add a setting OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION which defaults to True
• When logging-in, if the sub does not match any existing user, try matching on the email field before creating a new user for the unknown sub.

[qbey]

If the sub is random, how random is it? Is there not a risk of getting another user trying to use it?
Is there a way to know from the user info, the sub is random (so we can just ignore it and use the email instead)?