first attempt

lib/devise.rb

@@ -67,6 +67,10 @@ module Strategies
   mattr_accessor :request_keys
   @@request_keys = []
 
+  # If authentication keys should be case-insensitive by default.
+  mattr_accessor :case_insensitive_keys
+  @@case_insensitive_keys = false
+
   # If http authentication is enabled by default.
   mattr_accessor :http_authenticatable
   @@http_authenticatable = false

lib/devise/models/authenticatable.rb

@@ -77,7 +77,7 @@ def authenticatable_salt
       end
 
       module ClassMethods
-        Devise::Models.config(self, :authentication_keys, :request_keys, :http_authenticatable, :params_authenticatable)
+        Devise::Models.config(self, :authentication_keys, :request_keys, :case_insensitive_keys, :http_authenticatable, :params_authenticatable)
 
         def params_authenticatable?(strategy)
           params_authenticatable.is_a?(Array) ?
@@ -100,6 +100,9 @@ def http_authenticatable?(strategy)
         #   end
         #
         def find_for_authentication(conditions)
+          if case_insensitive_keys
+            authentication_keys.each { |k| conditions[k].try(:downcase!) }
+          end
           to_adapter.find_first(conditions)
         end
 
@@ -110,6 +113,10 @@ def find_or_initialize_with_error_by(attribute, value, error=:invalid) #:nodoc:
 
         # Find an initialize a group of attributes based on a list of required attributes.
         def find_or_initialize_with_errors(required_attributes, attributes, error=:invalid) #:nodoc:
+          if case_insensitive_keys
+            authentication_keys.each { |k| attributes[k].try(:downcase!) }
+          end
+
           attributes = attributes.slice(*required_attributes)
           attributes.delete_if { |key, value| value.blank? }
 

lib/generators/templates/devise.rb

@@ -31,6 +31,9 @@
   # The same considerations mentioned for authentication_keys also apply to request_keys.
   # config.request_keys = []
 
+  # If authentication keys should be case-insensitive. False by default.
+  # config.case_insensitive_keys = false
+
   # Tell if authentication through request.params is enabled. True by default.
   # config.params_authenticatable = true