external user can't login to a controller

I've got a controller up and it's been configure to use USSO for users and addmodel ACL to everyone@external.

I can create a model as external user, as well as some local user can grant me access as @external user. "juju models" return the list of models. Once a model is created, macaroons are retrieved, and I can act as external user.

But say that .go-cookies and store-usso-token are removed (or expired). The question is, how do I login as external user? "juju login uros-jovanovic@external" seems wrong as that info is provided by SSO.

Even if I try to login as external, it fails (as there's no record in the DB about that user).

parallels@ubuntu:~/.local/share/juju$ juju login
username: uros-jovanovic@external
ERROR user name "uros-jovanovic@external" not valid

This is really important in the case where I share my model to someone@external. How do they login to that model?

For now, getting credentials from SSO only works when you do "juju add-model", then the login procedure is started.