:thumbsup:

@simo Could you please take a look too?

Is this behavior specific to Fedora infrastructure?

Sounds like this should be a configurable ...

I don't mind making it configurable although it seems that current behavior breaks openid endpoint expectations given the client logs an error:

Discovery verification failure for http://ttomecek@redhat.com.id.fedoraproject.org/

so please let me know how should I proceed

So the question is whether _username is always available.
Tracing through the code it requires a module to call the auth_successful function to pass in the user name, this is what my grep shows:
ipsilon/login/authfas.py: return self.lm.auth_successful(self.trans,
ipsilon/login/authform.py: return self.lm.auth_successful(self.trans, user.name, 'password')
ipsilon/login/authgssapi.py: return self.lm.auth_successful(trans, self.user.name,
ipsilon/login/authldap.py: return self.lm.auth_successful(self.trans, username, 'password',
ipsilon/login/authpam.py: return self.lm.auth_successful(
ipsilon/login/authtest.py: return self.lm.auth_successful(self.trans,

These are all the login plugins, so it should be guaranteed ?
If we are confident that's the case I actually see no issue with this patch

I'm sorry but I'm not familiar with this codebase to make that call. Let me know what should I do here or how can I verify this works properly locally.

@abompard, does this complement #363?

@abompard's solution seems to be more universal. Thank you, Aurélien!