[jboss-jira] [JBoss JIRA] (ELY-865) Principal name from realms should not be pure user input

[Jan Kalina (JIRA)]

Jan Kalina created ELY-865:
------------------------------

             Summary: Principal name from realms should not be pure user input
                 Key: ELY-865
                 URL: https://issues.jboss.org/browse/ELY-865
             Project: WildFly Elytron
          Issue Type: Bug
            Reporter: Jan Kalina
            Assignee: Jan Kalina


All security realm now provides user-provided username as realmIdentity principal.
That can be problem, if identity search is case-insensitive for example:

* Lets have filesystem realm on windows - user will write "FIRSTuser", because filesystem is caseinsensitive, realm correctly found "firstUser" - but they will obtain two different NamePrincipal - the same user can be two different users for application running on AS
* the same problem can occure if LDAP search is case-insensitive - not sure, but I think this is case of Active Directory
* the same can probably occure for JDBC, if database column is defined as case-insensitive



--
This message was sent by Atlassian JIRA
(v7.2.3#72005)