[ https://issues.jboss.org/browse/ELY-857?page=com.atlassian.jira.plugin.sy... ] Jan Kalina edited comment on ELY-857 at 1/10/17 1:45 PM: --------------------------------------------------------- Notes: result of WhoAmIOperation is obtained as: {code:java}securityIdentity.getPrincipal().getName(){code} The principal is really output of realm: (see ServerAuthenticationContext class) {code:java}principal = getSecurityRealm().getRealmIdentity(evidence).getRealmIdentityPrincipal(){code} But in LdapRealm (and FileSystem and Jdbc too) it is currently hardcoded as username - input of the realm. *Possible solution:* a) add mapping from identity attribute to identity principal into LdapRealm (add "username-attribute into ldap-realm and map this identity attribute to NamePrincipal when defined) b) to use identity attribute instead of special method for principal to add this possibility into all realms at once? [~dlofthouse] do you think this should be solved for LDAP only, or on higher level? was (Author: honza889): Notes: result of WhoAmIOperation is obtained as: {code:java}securityIdentity.getPrincipal().getName(){code} The principal is really output of realm: (see ServerAuthenticationContext class) {code:java}principal = getSecurityRealm().getRealmIdentity(evidence).getRealmIdentityPrincipal(){code} But in LdapRealm (and FileSystem and Jdbc too) it is currently hardcoded as username - input of the realm. *Possible solution:* a) add mapping from identity attribute to identity principal into LdapRealm (add "username-attribute into ldap-realm and map this identity attribute to NamePrincipal when defined) b) to use identity attribute instead of special method for principal to add this possibility into all realms at once? [~dlofthouse] do you think this should be solved for LDAP only, or on higher level? Not sure but mabe the problem can occure also in FileSystemRealm - if there is user "firstUser", user can log in successfully as "FIRSTUSER" on Windows too - so he can obtain two different principals - realm should normalize it, or better use user input only for search, but the principal obtain from database :( -- This message was sent by Atlassian JIRA (v7.2.3#72005)