Return the uid instead of the username as the user_id / sub param

Are you creating the nodes on the server? Or on a client site?
Are you using Services or not?
Which grant type are you using?

We need to change the "sub" param to show the uid, not the username (because the username can change, so it isn't stable).

Though to be honest, the fact that you need the uid shows how uncomfortable Services is in this regard... Usually server code just takes the uid of the provided token.

We need to do this for the grant types as well.
(The uid is not changeable, but the username is, so it's clear what needs to be used in this context)

I agree that this is major - relying on the username isn't a good practice. I'd suggest a delegate function in the .module file for returning the user_id/sub value for consistency.

Am I right that we just need to replace all output around 'user_id' and 'sub' values? Or is this a more complex change?

Ok, I've had a go at implementing this...

I've adjusted the tests to match but I've not run them. I should also stress that I'm not completely familiar with this module yet. Most of my changes appear to be in the Storage class.

FYI, the tests work. But how do we deal with client sites that already using the username-based sub? I guess the patch does not make it configurable.

+++ b/lib/Drupal/oauth2_server/Storage.php
@@ -272,20 +270,22 @@ class Storage implements AuthorizationCodeInterface,
-      'sub' => $username,
+      'sub' => $uid,

Perhaps this could use uid by default, but use $user->name if configured via the module configuration form. An update function should ensure that sites keep the 'name' as the sub, and notify developers should they wish to change it.

This is #6, re-rolled, with the addition of:

• the variable 'sub' property as I mention in #8
• an update function so that previous installs get the old behaviour
• a test to ensure that the sub property can be changed successfully

Unfortunately this breaks OpenID Connect, because the user_id is still the 'sub' in the ID Token, here: https://github.com/bshaffer/oauth2-server-php/blob/master/src/OAuth2/Ope...

Following up in #2467319: Sub property config does not return the right sub in the ID token