I'm using Salesforce as the identity provider (IdP) in a single sign-on application I'm developing in php. After the user logs into Salesforce.com to authenticate, they are redirected to my app and the app gets a string of attributes from Salesforce, including any custom attributes I configure in the Connected App management panel inside Salesforce. E.g. userId, email, first name, etc.
I want to derive a globally unique user identifier from these attributes so that I can use it as an index into my own database table to store user preferences and manage their billing, that will persist even if the user changes their email address, etc.
From some reading it looks like userId is not globally unique, but perhaps by concatenating it with the Organization ID I can create a unique ID like so:
Is this a good technique or is there a best practice that can be applied here?
Or actually is the userId sufficient since it really links to an individual person no matter what org they log into?