keycloak: handle change of email

[mdonadoni]

The email change of a user logged in with Keycloak is currently not correctly handled by REANA.

Let's consider an user with email [email protected]. When logging in for the first time, a new user is created both in Invenio's and in REANA's tables, with the correct email:

reana=# select email from __reana.user_;
        email         
----------------------
 [email protected]
 [email protected]
(2 rows)

reana=# select email from accounts_user;
        email         
----------------------
 [email protected]
 [email protected]
(2 rows)

If this user changes his email, for example to [email protected], then a new user is created in REANA's table, while Invenio keeps using the old user. Given that authentication in reana-ui is handled by Invenio, the user is still able to see his workflows and to use his access token.

reana=# select email from __reana.user_;
        email         
----------------------
 [email protected]
 [email protected]
 [email protected]
(3 rows)

reana=# select email from accounts_user;
        email         
----------------------
 [email protected]
 [email protected]
(2 rows)

However, REANA should not create a new user with the new email provided by Keycloak. We should also check whether it is necessary to update the email in REANA's user table.