Currently, check<Type>Password query is used to verify if the credentials are correct for ID and the secret field (password in this case).
In case there are multiple IDs as in this case, preference is given to the field which is of type ID.
You should be able to use user_name and password for auth with the following schema,
type User @secret(field: "password") {
user_name: String! @id
age: int
}
What is your use case that you require both ID field and user_name field with @id directive ?
We can accept this as a feature request to have multiple ID fields in check<Type>Password query if it is a popular use case.