Provide an admin screen to merge accounts

[Selene ToyKeeper]

ISD Customer Support needs a way to manage user accounts, instead of passing requests along to canonical-losas or canonical-sysadmins. Users frequently want to merge accounts, recover their account, or delete old accounts, and it would be very helpful to be able to do this directly.

Viewing accounts would help in the cases where an account isn't working, to figure out why it's broken. Merging accounts is a common request when people accidentally make more than one, or don't realize they can use the same account for multiple services. Account deletion is probably optional if Bug #664229 gets resolved, though there are still occasional cases where someone has lost access to the email addresses tied to an account and can't log in to delete it on their own. Editing account details might prove useful too, but no specific use cases have come up yet. So, the most important bits are viewing and merging SSO accounts.

While merging SSO accounts, it's probably also a good idea to merge LP accounts if the user has any, instead of leaving an account dangling. So, LP merge functionality would be very helpful too.

This should allow us to resolve user issues more quickly, and to reduce the load for sysadmins.

[Selene ToyKeeper (toykeeper)]

FWIW, some other info on account management...
if the user wants to merge two LP accounts and has access to both, they can use this:

  https://launchpad.net/people/+requestmerge

If admin help is required, or if they want to merge SSO accounts, this works:

  https://wiki.canonical.com/InformationInfrastructure/OSA/ISDHowTo/MergeSSOAccounts

Users can cancel a LP account with this:

  https://launchpad.net/~myusername/+deactivate-account

This bug should eventually allow users to cancel their SSO accounts:

  https://bugs.launchpad.net/canonical-identity-provider/+bug/664229

Most of these depend on the user having access to their accounts though, which is often not the case.

[Selene ToyKeeper (toykeeper)]

For reference, I found the admin notes for how to remove SSO accounts:

https://wiki.canonical.com/InformationInfrastructure/OSA/ISDHowTo/DisableAccount

I'm not entirely sure which of the approaches listed there will work for the use case in Bug #664229 (delete SSO account, use same email address on a different account).

[Stuart Metcalfe (stuartmetcalfe)]

We can probably use the existing code from the command line operation and put an admin UI in front of it. It should be protected in the same way as the rest of the SSO admin.