Hi John,
I think we do something like what you are talking about. For one of our applications, we store an application specific username in the user’s app_metadata. I would suggest using app_metadata for this, not user_metadata. app_metadata is for attributes the user should not be able to edit themselves.
So you could have something like:
{
"app_metadata": {
"your_application": {
"username": "janedoe"
}
}
}
When the user logs in you will want to include that username attribute in the claim you send back to your application. You can use a rule to do this.