code: protected String determineIdentity(final OpenIdService service, final Assertion assertion) {
          if (assertion != null && OpenIdProtocolConstants.OPENID_IDENTIFIERSELECT.equals(service.getIdentity())) {
              return this.openIdPrefixUrl + '/' + assertion.getPrimaryAuthentication().getPrincipal().getId();
          }
          return service.getIdentity();
      }
docs: Determine identity.
  
  @param service   the service
  @param assertion the assertion
  @return the string