How to uniquely identify user in LTI

[soban_momin]

On LTI launch we get user id as "sub" claim in jwt.

Is the "sub" (i.e. user id) is globally unique in canvas?

If not, is it safe to assume that combination of "iss" and "sub" will always be globally unique?

[maguire]

User ids are unique in a given instance of Canvas.  Different Canvas instances can have different users associated with a given user_id.

In our local Canvas instance, we also have an integration_id that is a unique identifier for a student within a consortium of universities and colleges that share a common (national) records system. In this way, a student can take courses at university X with a Canvas user_id X and at a university Y with a Canvas user_id Y and they can still have the same intergation_id and a common record in the shared grading system.