Please do not put this in the default config and put the =False in the development config instead.

Instead of manually going to the OIDC ID Token, please use http://flask-oidc.readthedocs.io/en/latest/#flask_oidc.OpenIDConnect.user_getinfo.
You can also request the name, ssh_key and groups from that (and other fields as well).

For username, please use either preferred_username from the userinfo or sub as fallback.

Note that having an option to specify a username of this format is wanted is fine with me.

There's SESSION_COOKIE_SECURE = False couple of lines below, so that's why I assumed this was ok. Also, if this is set to True, then AFAICS this won't work out of the box on localhost, as you'd need to have https for localhost, correct? Also, where is development config?

So I tried info = oidc.user_getinfo(['email', 'name', 'preferred_username', 'groups', 'ssh_key']) (using Google as IdP), but I only got email and name back (and name was empty). Am I doing something wrong or is this expected?

sub for Google is numeric user id, would we really want to use that?

So, about this, you might want to look at http://flask-oidc.readthedocs.io/en/latest/#settings-reference, specifically the OIDC_SCOPES. If you set this to ['openid', 'email', 'profile'], you will get more information about the user.
Regarding the specific names, I would suggest to instead to add Pagure configuration options for the specific fields.
i.e.: in pagure's config, add PAGURE_OIDC_USERNAME = "mangledemail", PAGURE_OIDC_GROUPS = "groups", PAGURE_OIDC_USERNAME = "sub", etc.

For Google, yes. For others, it depends on the configuration. I would suggest to, as my other comments says, make this configurable, and maybe add a special value pagure_mangledemail where you do this email.split('@', 1)[0]?

Sorry, I only just now realized that this is commented out by default. Then I'm fine with it.
Maybe add the same type of message as SESSION_COOKIE_SECURE though, so people know what it means?

Thanks for all the comments @puiterwijk. I tried to address them in the second commit. I also had to remove the @oidc.require_login decorator, since oidc is not defined when another authentication method is used.

Maybe add a single space here so the first letters line up?

Other then one really tiny nitpick, looks good to me.

two spaces between full and name?