[MM-68463] New endpoint to GET user by auth_data (#36352)

api/v4/source/users.yaml

@@ -1534,6 +1534,54 @@
           $ref: "#/components/responses/Unauthorized"
         "404":
           $ref: "#/components/responses/NotFound"
+  /api/v4/users/auth_data:
+    get:
+      tags:
+        - users
+      summary: Get a user by auth data
+      description: >
+        Get a user by their external auth data identifier. The `value` is
+        matched against what is stored in `Users.AuthData`, which for most
+        identity providers is the identifier as the provider issues it.
+
+
+        The exception is Active Directory `objectGUID`: under
+        `auth_service: ldap` it is stored as the LDAP filter hex-escape
+        form (e.g. `\61\14\e1\d1\c5\35\18\4a\b6\60\d6\78\50\fd\0d\5d`),
+        and under `auth_service: saml` it is stored as the standard
+        Base64 of the same bytes (e.g. `YRTh0cU1GEq2YNZ4UP0NXQ==`). Use
+        the form matching the user's current `AuthService`.
+
+
+        ##### Permissions
+
+        Must be a system admin.
+      operationId: GetUserByAuthData
+      parameters:
+        - name: value
+          in: query
+          description: >
+            The user's AuthData as stored in `Users.AuthData`. Must be
+            URL-encoded; in particular, Base64 `+` characters must be sent
+            as `%2B` so they are not decoded as spaces.
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: User retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/User"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
   /api/v4/users/password/reset:
     post:
       tags: