@@ -11,8 +11,8 @@ type UserInfo interface {

 // UserIdentityInfo contains information about an identity.  Identities are distinct from users.  An authentication server of

 // some kind (like oauth for example) describes an identity.  Our system controls the users mapped to this identity.

 type UserIdentityInfo interface {

-	// GetName uniquely identifies this particular identity for this provider.  It is NOT guaranteed to be unique across providers

-	GetName() string

+	// GetUserName uniquely identifies this particular identity for this provider.  It is NOT guaranteed to be unique across providers

+	GetUserName() string

 	// GetProviderName returns the name of the provider of this identity.

 	GetProviderName() string

 	// GetExtra is a map to allow providers to add additional fields that they understand

@@ -64,21 +64,21 @@ func (i *DefaultUserInfo) GetExtra() map[string]string {

 }

 type DefaultUserIdentityInfo struct {

-	Name         string

+	UserName     string

 	ProviderName string

 	Extra        map[string]string

 }

 // NewDefaultUserIdentityInfo returns a DefaultUserIdentity info with a non-nil Extra component

-func NewDefaultUserIdentityInfo(name string) DefaultUserIdentityInfo {

+func NewDefaultUserIdentityInfo(username string) DefaultUserIdentityInfo {

 	return DefaultUserIdentityInfo{

-		Name:  name,

-		Extra: make(map[string]string),

+		UserName: username,

+		Extra:    make(map[string]string),

 	}

 }

-func (i *DefaultUserIdentityInfo) GetName() string {

-	return i.Name

+func (i *DefaultUserIdentityInfo) GetUserName() string {

+	return i.UserName

 }

 func (i *DefaultUserIdentityInfo) GetProviderName() string {

@@ -26,7 +26,7 @@ func (a alwaysAcceptPasswordAuthenticator) AuthenticatePassword(username, passwo

 	}

 	identity := &authapi.DefaultUserIdentityInfo{

-		Name: username,

+		UserName: username,

 	}

 	user, err := a.identityMapper.UserFor(identity)

 	glog.V(4).Infof("Got userIdentityMapping: %#v", user)

@@ -90,7 +90,7 @@ func (a *Authenticator) AuthenticatePassword(username, password string) (api.Use

 	}

 	identity := &authapi.DefaultUserIdentityInfo{

-		Name: username,

+		UserName: username,

 		Extra: map[string]string{

 			"name":  remoteUserData.Name,

 			"email": remoteUserData.Email,

@@ -80,7 +80,7 @@ func (p provider) GetUserIdentity(data *osincli.AccessData) (authapi.UserIdentit

 	}

 	identity := &authapi.DefaultUserIdentityInfo{

-		Name: fmt.Sprintf("%d", userdata.ID),

+		UserName: fmt.Sprintf("%d", userdata.ID),

 		Extra: map[string]string{

 			"name":  userdata.Name,

 			"login": userdata.Login,

@@ -67,7 +67,7 @@ func (p provider) GetUserIdentity(data *osincli.AccessData) (authapi.UserIdentit

 	}

 	identity := &authapi.DefaultUserIdentityInfo{

-		Name: id,

+		UserName: id,

 		Extra: map[string]string{

 			"name":  email,

 			"email": email,

@@ -1,7 +1,8 @@

 package identitymapper

 import (

-	kapi "github.com/GoogleCloudPlatform/kubernetes/pkg/api"

+	"errors"

+

 	authapi "github.com/openshift/origin/pkg/auth/api"

 	userapi "github.com/openshift/origin/pkg/user/api"

 	"github.com/openshift/origin/pkg/user/registry/useridentitymapping"

@@ -21,14 +22,18 @@ func NewAlwaysCreateUserIdentityToUserMapper(providerId string, userIdentityRegi

 func (p *alwaysCreateUserIdentityToUserMapper) UserFor(identityInfo authapi.UserIdentityInfo) (authapi.UserInfo, error) {

 	userIdentityMapping := &userapi.UserIdentityMapping{

 		Identity: userapi.Identity{

-			ObjectMeta: kapi.ObjectMeta{

-				Name: identityInfo.GetName(),

-			},

-			Provider: p.providerId, // Provider information from the provider plugin itself is not considered authoritative

+			Provider: p.providerId, // Provider id is imposed

+			UserName: identityInfo.GetUserName(),

 			Extra:    identityInfo.GetExtra(),

 		},

 	}

-	authoritativeMapping, _, err := p.userIdentityRegistry.CreateOrUpdateUserIdentityMapping(userIdentityMapping)

+	authoritativeMapping, ok, err := p.userIdentityRegistry.CreateOrUpdateUserIdentityMapping(userIdentityMapping)

+	if err != nil {

+		return nil, err

+	}

+	if !ok {

+		return nil, errors.New("Could not map identity to user")

+	}

 	ret := &authapi.DefaultUserInfo{

 		Name:  authoritativeMapping.User.Name,

@@ -12,15 +12,15 @@ func TestProvisionUser(t *testing.T) {

 	providerId := "papa"

 	identityMapper := NewAlwaysCreateUserIdentityToUserMapper(providerId, userIdentityRegistry)

 	identity := &authapi.DefaultUserIdentityInfo{

-		Name: "oscar",

+		UserName: "oscar",

 	}

 	identityMapper.UserFor(identity)

 	if userIdentityRegistry.CreatedUserIdentityMapping.Identity.Provider != providerId {

 		t.Errorf("Expected provider to be set to %v, but it was actually %v", providerId, userIdentityRegistry.CreatedUserIdentityMapping.Identity.Provider)

 	}

-	if userIdentityRegistry.CreatedUserIdentityMapping.Identity.Name != identity.GetName() {

-		t.Errorf("Expected name to be set to %v, but it was actually %v", identity.GetName(), userIdentityRegistry.CreatedUserIdentityMapping.Identity.Name)

+	if userIdentityRegistry.CreatedUserIdentityMapping.Identity.UserName != identity.GetUserName() {

+		t.Errorf("Expected username to be set to %v, but it was actually %v", identity.GetUserName(), userIdentityRegistry.CreatedUserIdentityMapping.Identity.UserName)

 	}

 }

@@ -28,6 +28,9 @@ type Identity struct {

 	// is assumed.

 	Provider string `json:"provider" yaml:"provider"`

+	// UserName uniquely represents this identity in the scope of the identity provider

+	UserName string `json:"userName" yaml:"userName"`

+

 	Extra map[string]string `json:"extra,omitempty" yaml:"extra,omitempty"`

 }

@@ -28,6 +28,9 @@ type Identity struct {

 	// is assumed.

 	Provider string `json:"provider" yaml:"provider"`

+	// UserName uniquely represents this identity in the scope of the identity provider

+	UserName string `json:"userName" yaml:"userName"`

+

 	Extra map[string]string `json:"extra,omitempty" yaml:"extra,omitempty"`

 }

@@ -18,7 +18,7 @@ func (*DefaultUserInitStrategy) InitializeUser(identity *api.Identity, user *api

 	}

 	name, ok := identity.Extra["name"]

 	if !ok {

-		name = identity.Name

+		name = identity.UserName

 	}

 	user.FullName = name

 	return nil

@@ -41,7 +41,9 @@ func (r *Etcd) GetUser(name string) (user *api.User, err error) {

 // CreateOrUpdateUserIdentityMapping implements useridentitymapping.Registry

 func (r *Etcd) CreateOrUpdateUserIdentityMapping(mapping *api.UserIdentityMapping) (*api.UserIdentityMapping, bool, error) {

-	name := fmt.Sprintf("%s:%s", mapping.Identity.Provider, mapping.Identity.Name)

+	// Create Identity.Name by combining Provider and UserName

+	name := fmt.Sprintf("%s:%s", mapping.Identity.Provider, mapping.Identity.UserName)

+	mapping.Identity.Name = name

 	key := makeUserKey(name)

 	// track the object we set into etcd to return

@@ -24,22 +24,23 @@ func NewTestEtcd(client tools.EtcdClient) *Etcd {

 // expect it to. If someone changes the location of these resources by say moving all the resources to

 // "/origin/resources" (which is a really good idea), then they've made a breaking change and something should

 // fail to let them know they've change some significant change and that other dependent pieces may break.

-func makeTestUserIdentityMapping(providerId, identityName string) string {

-	return fmt.Sprintf("/userIdentityMappings/%s:%s", providerId, identityName)

+func makeTestUserIdentityMapping(providerId, userName string) string {

+	return fmt.Sprintf("/userIdentityMappings/%s:%s", providerId, userName)

 }

 func TestEtcdGetUser(t *testing.T) {

 	fakeClient := tools.NewFakeEtcdClient(t)

 	expectedResultingMapping := &userapi.UserIdentityMapping{

 		Identity: userapi.Identity{

-			ObjectMeta: kapi.ObjectMeta{Name: "tango"},

+			ObjectMeta: kapi.ObjectMeta{Name: "victor:tango"},

 			Provider:   "victor",

+			UserName:   "tango",

 		},

 		User: userapi.User{

 			ObjectMeta: kapi.ObjectMeta{Name: "uniform"},

 		},

 	}

-	key := makeTestUserIdentityMapping(expectedResultingMapping.Identity.Provider, expectedResultingMapping.Identity.Name)

+	key := makeTestUserIdentityMapping(expectedResultingMapping.Identity.Provider, expectedResultingMapping.Identity.UserName)

 	fakeClient.Set(key, runtime.EncodeOrDie(latest.Codec, expectedResultingMapping), 0)

 	registry := NewTestEtcd(fakeClient)

@@ -66,13 +67,14 @@ func TestEtcdCreateUserIdentityMapping(t *testing.T) {

 	expectedResultingMapping := &userapi.UserIdentityMapping{

 		ObjectMeta: kapi.ObjectMeta{Name: "quebec"},

 		Identity: userapi.Identity{

-			Provider: "sierra",

+			ObjectMeta: kapi.ObjectMeta{Name: "sierra:"},

+			Provider:   "sierra",

 		},

 		User: userapi.User{

 			ObjectMeta: kapi.ObjectMeta{Name: "romeo"},

 		},

 	}

-	key := makeTestUserIdentityMapping(testMapping.Identity.Provider, testMapping.Identity.Name)

+	key := makeTestUserIdentityMapping(testMapping.Identity.Provider, testMapping.Identity.UserName)

 	fakeClient.Data[key] = tools.EtcdResponseWithError{

 		R: &etcd.Response{

@@ -101,11 +103,12 @@ func TestEtcdUpdateUserIdentityMappingWithConflictingUser(t *testing.T) {

 	startingMapping := &userapi.UserIdentityMapping{

 		ObjectMeta: kapi.ObjectMeta{Name: "whiskey"},

 		Identity: userapi.Identity{

-			ObjectMeta: kapi.ObjectMeta{Name: "xray"},

+			ObjectMeta: kapi.ObjectMeta{Name: "yankee:xray"},

 			Provider:   "yankee",

+			UserName:   "xray",

 		},

 		User: userapi.User{

-			ObjectMeta: kapi.ObjectMeta{Name: "xray"},

+			ObjectMeta: kapi.ObjectMeta{Name: "yankee:xray"},

 		},

 	}

 	// this key is intentionally wrong so that we can have an internally consistend UserIdentityMapping

@@ -117,8 +120,8 @@ func TestEtcdUpdateUserIdentityMappingWithConflictingUser(t *testing.T) {

 	testMapping := &userapi.UserIdentityMapping{

 		ObjectMeta: kapi.ObjectMeta{Name: "bravo"},

 		Identity: userapi.Identity{

-			Provider:   "zulu",

-			ObjectMeta: kapi.ObjectMeta{Name: "alfa"},

+			Provider: "zulu",

+			UserName: "alfa",

 		},

 		User: userapi.User{},

 	}

@@ -147,7 +150,7 @@ func compareUserIdentityMappingFieldsThatAreFixed(expected, actual *userapi.User

 	if actual.Name != expected.Name {

 		return false

 	}

-	if actual.Identity.Name != expected.Identity.Name || actual.Identity.Provider != expected.Identity.Provider {

+	if actual.Identity.UserName != expected.Identity.UserName || actual.Identity.Provider != expected.Identity.Provider {

 		return false

 	}

 	if actual.User.Name != expected.User.Name || actual.User.Name != actual.User.Name {

@@ -47,8 +47,9 @@ func TestUserInitialization(t *testing.T) {

 	mapping := api.UserIdentityMapping{

 		Identity: api.Identity{

-			ObjectMeta: kapi.ObjectMeta{Name: "test"},

+			ObjectMeta: kapi.ObjectMeta{Name: ":test"},

 			Provider:   "",

+			UserName:   "test",

 			Extra: map[string]string{

 				"name": "Mr. Test",

 			},

@@ -133,8 +134,9 @@ func TestUserLookup(t *testing.T) {

 	mapping := api.UserIdentityMapping{

 		Identity: api.Identity{

-			ObjectMeta: kapi.ObjectMeta{Name: "test"},

+			ObjectMeta: kapi.ObjectMeta{Name: ":test"},

 			Provider:   "",

+			UserName:   "test",

 			Extra: map[string]string{

 				"name": "Mr. Test",

 			},