macaroon auth can fail to set username properly

Looking into this further, I am not yet sure if there's a bug or not.

If the login macaroon has the username as a first party caveat, which it will do after SSO, then the Juju controller seems to extract the user name from there, rather than an explicit login arg.

I can't test fully against canonical-jimm.jujucharms.com until the jimm-admin utility is fixed to allow my user to be grant read access to a model. Testing without access to a model seems to result in a "no models for you" error which is expected.

This is looking like a JIMM bug. I tested with stand alone 2.8 controller like so:

1. bootstrap a controller using SSO as the identity manager

juju bootstrap lxd --config identity-url=https://api.jujucharms.com/identity --config identity-public-key=hmHaPgCC1UfuhYHUSX5+aihSAZesqpVdjRv0mgfIwjo= test

2. grant access to the model "admin/default" to wallyworld@external

juju grant everyone@external login
juju grant wallyworld@external read default

3. from a different machine, run status on hte model.
copy just the controller.yaml from the original bootstrap client and nothing else
(so no modes or account details are present)

juju status -m test:admin/default
Opening an authorization web page in your browser.
If it does not open, please open this URL:
https://api.jujucharms.com/identity/login?did=1b8d0da3614cd71fb1c66ebd80c448f99da6bc4d70e70940c8c08be22fc88016
Opening in existing browser session.

<snip>

---

So a single controller handles macaroon auth to an external identity provider starting from having no existing user details or model info cached locally.

The same workflow seems to fail on a JAAS controller where the Login() and model redirect goes via JIMM.

This bug has not been updated in 2 years, so we're marking it Low importance. If you believe this is incorrect, please update the importance.