Add note about external_ids for User Admin API in documentation

[sanjacob]

If the login method is OIDC then the external id provider must be prefixed with 'oidc-', which was not mentioned before.

Pull Request Checklist

• Pull request is based on the develop branch
• Pull request includes a changelog file. The entry should:
  • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
  • Use markdown where necessary, mostly for code blocks.
  • End with either a period (.) or an exclamation mark (!).
  • Start with a capital letter.
  • Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
• Code style is correct
  (run the linters)

[CLAassistant]

All committers have signed the CLA.

[erikjohnston]

Hmm, TBH it feels like we should make it error rather than silently fail? But I'm not really quite sure how this is meant to work, @sandhose do you know what's going on here?

[clokep]

It is meant to support that so you can add or remove OIDC providers. Ie you want to register OIDC login info first for every user, then update the Synapse config to actually use SSO.

Maybe that doesn't make sense, but that was the initial design IIRC.

[sandhose]

@erikjohnston In other contexts we do somewhat use it as an arbitrary key-value thing (I know, it's as bad as it sounds), so making this an error would break those. It's also used with delegated auth to store the delegated IDP subject <-> MXID mapping

[sanjacob]

I am using the API to register users from another service (since that service knows their OIDC provider and sub) and thus the users can simply log into Synapse from the start, without needing to sign up again and without allowing other users to simply register in Synapse directly. Perhaps having my own OIDC service would make more sense, but it works for my use case.