sub
What this is
sub should be unique within the issuer and never reused for a different person. OIDC treats iss + sub as the globally unique account key. Do not put email in sub if the user can change email; use an opaque id.
FAQ
- Is sub the username?
- Often it is a UUID or provider id, not a login. Treat it as an opaque primary key.