Oh boy---thanks for finding this 😅.

I think my intention was to use a unique field that wasn't the username since the username has some caveats. The username will be for their effective identity (i.e., for their default identity). This might cause issues if authenticated with one identity (e.g., UChicago) on machine A and a different identity (e.g., NERSC) on machine B.

Maybe doing an intersection of identity_sets would be better? Or maybe this isn't an issue and username reliable?

Hmm, I haven't tried it, but I thought username would be fine. From the SDK docs, the username is derived from the sub field, and the sub field will be the "primary identity of the account" unless a specific identity is requested by the client. Since the Proxystore client doesn't request a specific identity provider, I think it should always be the primary identity, regardless of how a user authenticates.

I switched this PR to use sub based on the recommendation from the Globus auth team. sub is unique to a Globus user identity, while username is only unique at a certain point in time.

Thanks for figuring that out! Will make a release and update the prod relay server this week.