src/server/auth/server/api_server.go
func (a *apiServer) canonicalizeSubject(ctx context.Context, subject string) (string, error) {
	colonIdx := strings.Index(subject, ":")
	if colonIdx < 0 {
		subject = authclient.GitHubPrefix + subject
		colonIdx = len(authclient.GitHubPrefix) - 1
	}
	prefix := subject[:colonIdx]
	a.configMu.Lock()
	defer a.configMu.Unlock()

	// check prefix against config cache
	if a.configCache != nil {
		if prefix == a.configCache.IDP.Name {
			return subject, nil
		}
		if prefix == path.Join("group", a.configCache.IDP.Name) {
			return subject, nil // TODO(msteffen): check if this IdP supports groups
		}
	}

	// check against fixed prefixes
	prefix += ":" // append ":" to match constants
	switch prefix {
	case authclient.GitHubPrefix:
		var err error
		subject, err = canonicalizeGitHubUsername(ctx, subject[len(authclient.GitHubPrefix):])
		if err != nil {
			return "", err
		}
	case authclient.PipelinePrefix, authclient.RobotPrefix:
		break
	default:
		return "", fmt.Errorf("subject has unrecognized prefix: %s", subject[:colonIdx+1])
	}
	return subject, nil
}
func (a *apiServer) canonicalizeSubject(ctx context.Context, subject string) (string, error) {
	colonIdx := strings.Index(subject, ":")
	if colonIdx < 0 {
		subject = authclient.GitHubPrefix + subject
		colonIdx = len(authclient.GitHubPrefix) - 1
	}
	prefix := subject[:colonIdx]
	a.configMu.Lock()
	defer a.configMu.Unlock()

	// check prefix against config cache
	if a.configCache != nil {
		if prefix == a.configCache.IDP.Name {
			return subject, nil
		}
		if prefix == path.Join("group", a.configCache.IDP.Name) {
			return subject, nil // TODO(msteffen): check if this IdP supports groups
		}
	}

	// check against fixed prefixes
	prefix += ":" // append ":" to match constants
	switch prefix {
	case authclient.GitHubPrefix:
		var err error
		subject, err = canonicalizeGitHubUsername(ctx, subject[len(authclient.GitHubPrefix):])
		if err != nil {
			return "", err
		}
	case authclient.PipelinePrefix, authclient.RobotPrefix:
		break
	default:
		return "", fmt.Errorf("subject has unrecognized prefix: %s", subject[:colonIdx+1])
	}
	return subject, nil
}
// canonicalizeSubject establishes the type of 'subject' by looking for one of
// pachyderm's subject prefixes, and then canonicalizes the subject based on
// that. If 'subject' has no prefix, they are assumed to be a GitHub user.
// TODO(msteffen): We'd like to require that subjects always have a prefix, but
// this behavior hasn't been implemented in the dash yet.