Interop for github provider and EmailDomains

[donaldguy]

People (like my coworkers) often use the same github account for both work and other purposes. As such they end up having multiple email addresses set up for the same account

When using the pass-basic-auth, the X-Forwarded-Email and X-Forwarded-User end up passing their primary email and prefix thereof, which due to githubs configurability of notifications, may or may not be their work email. For systems which use the values of these headers to autovivify downstream users, confusion is introduced into the naming schemes, and in especially bad cases you could accidentally end up sending confidential notifications out of band.

While obviously there are more policy-level solutions, this is my proposal at a technical solution.

I suspect there may be a better way to achieve it, but this is a first pass; Let me know what you think. Thanks :D

[donaldguy]

To answer the ~obvious question of why use github if I care about email validation, I am using this cherry-picked on top of #277 to front Rundeck and as far as I understand, github is my best source of the roles data Rundeck needs to function

[sto1t]

Hi Donald,

I like this enhancement, it's immediately useful for the Github provider. 👍

A related case for reference: In a recent implementation we couldn't rely on all users having the same email domain (contractors, for example). So we are passing the user's Github ID as a unique identifier in lieu of the mailbox name - #276

John