SCIM: Update authinfoquery (#103123)

* Rewrite mismatched externalUID error message

* Update AuhtInfo if user exists

pkg/services/authn/authnimpl/sync/user_sync.go

@@ -48,7 +48,7 @@ var (
 	)
 	errMismatchedExternalUID = errutil.Unauthorized(
 		"user.sync.mismatched-externalUID",
-		errutil.WithPublicMessage("Mismatched externalUID"),
+		errutil.WithPublicMessage("Mismatched provisioned identity"),
 	)
 	errEmptyExternalUID = errutil.Unauthorized(
 		"user.sync.empty-externalUID",
@@ -134,6 +134,11 @@ func (s *UserSync) SyncUserHook(ctx context.Context, id *authn.Identity, _ *auth
 		}
 	}
 
+	if usr.IsProvisioned && id.ExternalUID != userAuth.ExternalUID {
+		s.log.Error("mismatched externalUID", "provisioned_externalUID", userAuth.ExternalUID, "identity_externalUID", id.ExternalUID)
+		return errMismatchedExternalUID.Errorf("externalUID mistmatch")
+	}
+
 	syncUserToIdentity(usr, id)
 	return nil
 }

pkg/services/login/authinfoimpl/store.go

@@ -151,10 +151,11 @@ func (s *Store) SetAuthInfo(ctx context.Context, cmd *login.SetAuthInfoCommand)
 
 func (s *Store) UpdateAuthInfo(ctx context.Context, cmd *login.UpdateAuthInfoCommand) error {
 	authUser := &login.UserAuth{
-		UserId:     cmd.UserId,
-		AuthModule: cmd.AuthModule,
-		AuthId:     cmd.AuthId,
-		Created:    GetTime(),
+		UserId:      cmd.UserId,
+		AuthModule:  cmd.AuthModule,
+		AuthId:      cmd.AuthId,
+		Created:     GetTime(),
+		ExternalUID: cmd.ExternalUID,
 	}
 
 	if cmd.OAuthToken != nil {

pkg/services/login/model.go

@@ -81,10 +81,11 @@ type SetAuthInfoCommand struct {
 }
 
 type UpdateAuthInfoCommand struct {
-	AuthModule string
-	AuthId     string
-	UserId     int64
-	OAuthToken *oauth2.Token
+	AuthModule  string
+	AuthId      string
+	UserId      int64
+	OAuthToken  *oauth2.Token
+	ExternalUID string
 }
 
 type DeleteAuthInfoCommand struct {