feat: impersonate with email prefix

[betodealmeida]

SUMMARY

This PR adds a new feature flag, IMPERSONATE_WITH_EMAIL_PREFIX. When the flag is on (default is off) the user impersonation functionality will use the email prefix as the username, instead of the actual username.

This is useful for deployments using OAuth2 for login, where the username might be something like:

> SELECT username, email FROM ab_user;
google-oauth2|633391720998176487074, [email protected]

With the feature flag on the impersonation would use beto as the username passed to the database.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A

TESTING INSTRUCTIONS

Added unit tests.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[john-bodley]

@betodealmeida given this seems to be associated with OAuth are there existing OAuth related feature flags/configurations which could be leveraged?

[eschutho]

LGTM, but pending after @john-bodley's question is answered.

[betodealmeida]

@betodealmeida given this seems to be associated with OAuth are there existing OAuth related feature flags/configurations which could be leveraged?

To clarify, the OAuth I mention here is for authentication, not authorization (#20300).

We could do something like:

from flask_appbuilder.security.manager import AUTH_REMOTE_USER

if config.AUTH_TYPE == AUTH_REMOTE_USER:
    # use email prefix instead of username

But I'm not familiar with all types of OAuth login, so I'd rather not assume that's always true.