I’ve just encountered a situation where I think changing the external ID is legitimate. One of our users has moved from one school to another, and when they did this, they were assigned a new account – with a new UUID and email address. They’ve since started using this account to connect with other third-party applications.
They then realised that they could no longer access their account on our Discourse instance – they had a new user created.
At this point, I should have got in touch with the Discourse team to merge the accounts, but I thought I might be able to get away without doing so…
I updated their email address on the old account so that it matches their new email address – but they’re unable to log in because the external ID they’re using doesn’t match that account, and a new account can’t be created because the email address is in use. If I could simply edit their external ID, it would mean they could carry on quite happily.
I understand why there would be concerns around making a “merge user” function easily accessible from the admin interface; my feeling is that being able to edit the external ID for a user would likely mean that many merges aren’t necessary.
(As it stands, I’m seeing if I can change the UUID in our system for this user, but if they’ve used it to access other third-party systems, I’ll end up having to ask the Discourse team to help me out… )