Admin username case

Openfire Openfire Support
1

Working with 2.6.2 here.

I just spent quite a while trying to figure out why I could no longer log in to my admin console after switching to LDAP auth, while client auth was still working. I finally discovered by accident that it was a case-sensitivity issue. In XMPPServer.java:230 we have:

while (tokenizer.hasMoreTokens()) {

String username = tokenizer.nextToken();

try {

admins.add(createJID(username.toLowerCase().trim(), null));

All admin usernames get downcased. I was trying to log in with my mixed-case username which matches the uid in my LDAP server, and Wildfire wasn’‘t even doing an LDAP lookup at login time, because apparently it compares the login username as presented in the login form with the list of downcased admin usernames, and doesn’'t even bother trying to auth if there is no match.

Shouldn’'t there be an equivalent downcasing of the form username before comparison?

2

Actually, I think it it should leave the case alone entirely. Many jabber clients treat usernames as case sensitive, LDAP certainly does in many cases. While it might be odd to have Admin and not admin, it seems reasonable to me. Its a simple fix too. If nothing else, maybe we should add a new feature to toggle case sensitivity in usernames?

3

Well, the expectation for all the LDAP servers I’‘ve worked with is that usernames are case-insensitive. But I’'d like to see an option for making usernames globally case-sensitive or -insensitive. This would apply not only to jabber logins but also the admin interface.

4

The nice thing about LDAP is the schema’'s are completely customizable. That fact alone makes having some switch for case sensitivity a good idea.