Change the resource to `user/externalids` since we are using `login/*` as a special case for indicating that login provider as being mandatory.