AzureAD: use objectId instead of UPN as unique identifier

[Exordian]

Expected behaviour

Use Azure objectId as identifier.

Actual behaviour

UPN is used as user identifier [1].

What are the steps to reproduce this issue?

Use Azure AD authentication.

Any logs, error output, etc?

Any other comments?

The UPN should reflect the primary mail as recommended by Microsoft [2]. The e-mail address might change over time due to a new name of the person, merger and acquisitions or similar actions.

Microsoft recommends to use the objectId as unique identifier.

[1]

social-core/social_core/backends/azuread.py

Line 81 in 98c81ad

return response.get('upn')

[1] https://docs.microsoft.com/en-us/azure/active-directory/hybrid/howto-troubleshoot-upn-changes

[svdHero]

@Exordian That would be oid then and not objectId, wouldn't it?

[joachimBurket]

@svdHero yes it would be the oid.
I also saw that the upn, preferred_username, or sub claims are used as the unique identifier (depending on the class), and I also thought that the oid was the claim recommended by Microsoft.

[joachimBurket]

I can make a PR to change it, but as I'm just starting to use this library, I'm not sure what it would imply on existing applications.

[nijel]

Just changing upn to oid would break existing associations. I don't think there is currently an existing way to migrate to a different user identifier gracefully.