The thing is that something like `persistent-id` can't be used since it's different for different service providers, so if that is selected as the external identity it has an irreversible impact on user mapping, no other external applications will know what our `persistent-id` is with the IdP.

My assumption was that user mapping would not strictly happen on the external identity (`remote_user`), and could really use any canonical provider attribute (twitter handle, Shibboleth eppn, etc...). Assuming that's true and we are implementing a different per-tenant source for user-mappings, then I think we'd always just want to use `persistent-id` or some equivalent for this.

On the other hand, if user mapping *only* happens VIA the external ID, then `persistent-id` should *never* be used as the `remote_user`.