Use nhs login sub as main unique user identifier

.env.example

@@ -15,3 +15,4 @@ POSTGRES_PASSWORD=password
 OIDC_RP_CLIENT_PRIVATE_KEY="MYSUPERSECRETPRIVATEKEY"
 OIDC_RP_CLIENT_ID="lcrc"
 OIDC_OP_FQDN="https://example.com"
+NHS_LOGIN_SETTINGS_URL="https://settings.example.com"

lung_cancer_screening/core/jinja2/layout.jinja

@@ -18,11 +18,16 @@
     },
     "account": {
       "items": [
+        {
+          "text": request.user.full_name,
+          "href": NHS_LOGIN_SETTINGS_URL,
+          "icon": True
+        },
         {
           "text": "Log out",
           "href": url("questions:logout")
         }
-      ]
+      ] if request.user.is_authenticated else []
     }
   }) }}
 {% endblock header %}

lung_cancer_screening/jinja2_env.py

@@ -26,7 +26,12 @@ def environment(**options):
         )
 
     env.globals.update(
-        {"static": static, "url": reverse, "STATIC_URL": settings.STATIC_URL}
+        {
+            "static": static,
+            "url": reverse,
+            "STATIC_URL": settings.STATIC_URL,
+            "NHS_LOGIN_SETTINGS_URL": settings.NHS_LOGIN_SETTINGS_URL,
+        }
     )
 
     env.filters.update(

lung_cancer_screening/questions/auth.py

@@ -18,7 +18,7 @@ class NHSLoginOIDCBackend(OIDCAuthenticationBackend):
     """
     Custom OIDC authentication backend that uses private key JWT
     for client authentication instead of client secret.
-    Uses NHS number as the username field.
+    Uses sub as the username field.
     """
 
     def filter_users_by_claims(self, claims):
@@ -34,21 +34,27 @@ def filter_users_by_claims(self, claims):
     def create_user(self, claims):
         user_class = get_user_model()
 
-        nhs_number = claims.get('nhs_number')
-        if not nhs_number:
-            raise ValueError("Missing 'nhs_number' claim in OIDC token")
+        sub = claims.get('sub')
+        if not sub:
+            raise ValueError("Missing 'sub' claim in OIDC token")
 
-        email = claims.get('email')
         return user_class.objects.create_user(
-            nhs_number=nhs_number,
-            email=email
+            sub=claims.get('sub'),
+            nhs_number=claims.get('nhs_number'),
+            email=claims.get('email'),
+            given_name=claims.get('given_name'),
+            family_name=claims.get('family_name'),
         )
 
     def update_user(self, user, claims):
-        email = claims.get('email')
-        if email and user.email != email:
-            user.email = email
-            user.save()
+        user.sub = claims.get('sub'),
+        user.nhs_number = claims.get('nhs_number')
+        user.email = claims.get('email')
+        user.given_name = claims.get('given_name')
+        user.family_name = claims.get('family_name')
+
+        user.save()
+
         return user
 
     def _create_client_assertion(self):