Usernames are case sensitive

[khudgins]

Describe the bug
Usernames in the Rundeck database are case sensitive. This creates issues when interacting with LDAPuser stores that are case insensitive - we can create multiple user records for the same actual user when that happens.

My Rundeck detail

• Rundeck version: All of them, current as of 3.3.7+
• install type: All
• OS Name/version: all
• DB Type/version: all

To Reproduce

Log into Rundeck through the Rundeck login screen with LDAP auth enabled.

Log out.

Log in with the same user, but capitalized differently.

Log out.

Rundeck creates two internal user records based on the different capitalized usernames.

[hs-hub-world]

Agree! And it generates redundant entries under the user summary page.

[gaddman]

This also creates problems with ACLs. For example, if an ACL is created with a lower-case username allowing access to key storage, and then the user logs in with the same username but in a different case they will have no access to their keys.

[niall-munnelly]

It also sounds like a potentially expensive bug for Enterprise users.

On Tue, Mar 9, 2021 at 11:01 PM Christopher Gadd ***@***.***> wrote: This also creates problems with ACLs. For example, if an ACL is created with a lower-case username allowing access to key storage, and then the user logs in with the same username but in a different case they will have no access to their keys. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#6733 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AEHDCC2WIID6AWKY75MBP7DTC3VKBANCNFSM4WLIBWFQ> .

-- Yours, Niall.

[a118n]

Can confirm, fresh installation of Rundeck 3.4.4 - the bug is present.
Anything being done about it?
I think LDAP users should be distinguishable by their SID, not case-sensitive SamAccountName...

[a118n]

Rundeck 3.4.5 - issue still persists.

[gaddman]

For matching ACLs the support team have advised us to use a regex. Which works and, because our ACLs are scripted, is easy enough:

by:
  username: [mM][yY][uU][sS][eE][rR]

[runwaldo]

another workaround could be adding caseInsensitive="true" to the jaas login module so all usernames are passed to the payload as lower case by the default.

[stale]

In an effort to focus on bugs and issues that impact currently supported versions of Rundeck, we have elected to notify GitHub issue creators if their issue is classified as stale and close the issue. An issue is identified as stale when there have been no new comments, responses or other activity within the last 12 months. If a closed issue is still present please feel free to open a new Issue against the current version and we will review it. If you are an enterprise customer, please contact your Rundeck Support to assist in your request.
Thank you, The Rundeck Team