It seems like this logic of how to map the external auth to the internal user is going to vary over most types of external auth. Can we push this down into an external auth provider class, so that as we have more types of providers, they can each have their own logic, and we don't have to have a bunch of conditionals in this chunk of the code?