What would cause a user to change userid on login?

What would cause a user to change userid on login?

I'm trying to diagnose a problem on a CentOS machine in a corporate
environment. It's a box someone else configured before leaving the
company. The issue is that when we su to the user gitlab, we're actually
the user gitauth. There's nothing in /etc or its subdirs that contains the
string gitauth. What would cause this? Perhaps an external profile for the
user in ActiveDirectory or LDAP? My core question is - what should I look
for to point to where the gitauth user is coming from?
[me@blah ~]$ sudo su - gitlab
[gitauth@blah ~]$ id
uid=398473190(gitauth) gid=398473190(gitauth) ...