Turns out that the
endpoint_identifier_order doesn’t need to be changed or set.
Setting the parameter
identify_by=auth_username in the endpoint section is enough to force authentication via authentication username instead of username in the from header.
Thank you for your help, I really appreciate it.
You might also want to consider changing PJSIP to support using a registered IP address to do inbound IP based matching.