OIDC should use eppn instead of login name for OIDC

[ryan-carroll-graylog]

What?

Customer would like to use EPPN (eduPersonPrincipalName) instead of login name for OIDC.

From Support issue: https://github.com/Graylog2/support/issues/58

Why?

They use multi-organisational schema so primary identifier should be user@realm.
Now when they log in as [email protected], account name is 'user'.
This is a problem because there could be more logins 'user' for different organisations.
They need to have the username non-stripped so they can fully utilise multi-tenant setup.

• Strip Realm from UserID: Strips all data starting with the delimiter character from the user ID. This allows a submitted user ID, such as an email address ([email protected]), to be authenticated as the UserID which is happening now.
  They have used trusted header authentication with apache and shibboleth before.

Customer Environment

Graylog Version: 6.0.3

(created from Zendesk ticket #600)
gz#600