title: OAuth always failing registering existing users
body: <p>I'm seeing some behavior out of the <strong>SonarQube 5.4 OAuth</strong> code that just doesn't make sense (one of those, this how could have never worked issues) so I know I'm missing something but I just don't see it.  </p>
  
  <p>I'm attempting to authenticate into a SonarQube 5.4 server with <strong>sonar-auth-github-plugin, version 1.1.1</strong>.  </p>
  
  <p>I can authenticate in using my gitlab credentials just fine the first time, however every attempt after that fails with the exception/error:  </p>
  
  <pre><code>org.sonar.server.exceptions.BadRequestException: user.password_cant_be_changed_on_external_auth
          at org.sonar.server.user.UserUpdater.updateUserDto(UserUpdater.java:258) ~[sonar-server-5.4.jar:na]
          at org.sonar.server.user.UserUpdater.update(UserUpdater.java:149) ~[sonar-server-5.4.jar:na]
          at org.sonar.server.authentication.UserIdentityAuthenticator.register(UserIdentityAuthenticator.java:56) ~[sonar-server-5.4.jar:na]
          at org.sonar.server.authentication.UserIdentityAuthenticator.authenticate(UserIdentityAuthenticator.java:44) ~[sonar-server-5.4.jar:na]
  </code></pre>
  
  <p>Tracing through the server code (and watching the updates to the mysql DB), the error makes perfect sense...after the first attempt the logic checks the DB for a matching user, finds it, routes the request to <strong>UserIdentityAuthenticator::registerExistingUser()</strong>, who in turn calls <strong>UserUpdater::update()</strong> with the data coming info from the oauth user profile data.  </p>
  
  <p>The problem is when its sets the ExternalIdentity data (provider and user ID) it also sets UpdateUser's <strong>externalIdentityChanged = true</strong>, which causes </p>
  
  <p><code>UserUpdater::isNewExternalIdentityNotEqualsToSonaQube</code> </p>
  
  <p>to incorrectly return false because this check:   </p>
  
  <pre><code>"if (updateUser.isExternalIdentityChanged() &amp;&amp; externalIdentity != null)"
  </code></pre>
  
  <p>which causes <strong>UserUpdater::UpdateUserDto()</strong> to mistakenly think its an update to a local account and attempt to update the encrypted password field.</p>
  
  <p>I've looked for properties that I could set to somehow reroute the logic or prevent this incorrect flow but I've had no luck.  </p>
  
  <p>So I'm in the position of having to ask....how does this ever work for more than a single login attempt?  and more importantly what am I missing?</p>
  
  <p>Any help would be appreciated.</p>