I don't see the need for the AuthSourceExternal name to be configurable, as we're not allowing the user to manage these objects.  I'm wondering instead if it should be fixed via a class method on AuthSourceExternal in the same way as User.admin.