View Issue Details

Related ChangesetsJump to NotesJump to History
This issue affects 1 person(s).
 8
IDProjectCategoryView StatusDate SubmittedLast Update
19595Bug reportsPluginspublic2024-06-09 11:292026-10-13 11:49
Reportermifritscher Assigned Toc_schmitz  
PrioritynoneSeveritypartial_block 
Status closedResolutionfixed 
Product Version6.5.x 
Summary19595: Auth and AuthLDAP: different case sensitivy
Description

AuthLDAP is case insensitive regarding the username, whereas Limesurvey itself is.

This leads to double accounts in LimeSurvey if someone uses both e.g. MichaelMustermann and michaelmustermann.

Steps To Reproduce

Steps to reproduce

Configure LDAP. Use multiple variants of the loginname (MichaelMustermann and michaelmustermann)

Expected result

Creation of one account. Either both variants are able to login, or the "wrong" variant is blocked.

Actual result

Creation of two accounts.

TagsNo tags attached.
Bug heat8
Complete LimeSurvey version number (& build)6.5.11+240605
I will donate to the project if issue is resolvedNo
Browser
Database type & versionPostgreSQL 13.14-0+deb11u1
Server OS (if known)Debian 11
Webserver software & version (if known)Apache 2.4.59-1~deb11u1
PHP Version7.4.33
Git branch / Pull Request URL

Users monitoring this issue

There are no users monitoring this issue.

Activities

gabrieljenik

gabrieljenik

2024-08-05 16:50

developer   ~80741

I think this ticket is not a good fit to be assigned.
No experience with LDPA. Not used to working on identity flows and related stuff either.
Maybe someone else can review it?

Having said that, please find some analysis below.

Analysis

I suppose that to start with, when creating the user in Lime (during auto-creation) it should be done in lowercase. And then, when logging in and setting the “identity”, it should be done in lowercase as well.

The problem with that is that if someone usually uses uppercase, and already has a user in Lime with uppercase, it could become a problem.

To avoid that happening, you should create the user in lowercase, and in login look for one that matches exactly or, if it doesn't match, try with lowercase. But it doesn't seem like a good idea to let it work like that.
DenisChenu

DenisChenu

2025-01-31 16:44

developer   ~81931

But we already fix this one some year ago ?

Why happen again ?
https://github.com/LimeSurvey/LimeSurvey/pull/2692
DenisChenu

DenisChenu

2025-01-31 16:46

developer   ~81932

Oh :)
PostgreSQL

https://github.com/LimeSurvey/LimeSurvey/pull/2692#issuecomment-1297228553

To test i need to setup on my LDAP server?
Some time
c_schmitz

c_schmitz

2026-10-08 18:22

administrator   ~86269

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=40713
LimeBot

LimeBot

2026-10-13 11:49

administrator   ~86374

Fixed in Release 7.6.0+261013

Related Changesets

LimeSurvey: master 84701db1

2026-10-08 18:22

c_schmitz


Details Diff		 Fixed issue 19595: Logging in via LDAP with a different upper/lower case username created a second user on PostgreSQL
Dev Existing users are now looked up case-insensitively like the LDAP server does, and LDAP user creation rejects usernames differing only by case		 Affected Issues
19595
mod - application/core/plugins/AuthLDAP/AuthLDAP.php Diff File
add - tests/unit/plugins/AuthLDAPTest.php Diff File

Issue History

Date Modified Username Field Change
2024-06-09 11:29 mifritscher New Issue
2024-07-16 16:38 tibor.pacalat Assigned To => gabrieljenik
2024-07-16 16:38 tibor.pacalat Status new => assigned
2024-08-05 16:50 gabrieljenik Note Added: 80741
2024-08-05 16:50 gabrieljenik Bug heat 0 => 2
2024-09-26 21:49 gabrieljenik Assigned To gabrieljenik => tibor.pacalat
2024-09-26 21:49 gabrieljenik Status assigned => feedback
2025-01-31 13:39 tibor.pacalat Assigned To tibor.pacalat => DenisChenu
2025-01-31 13:39 tibor.pacalat Status feedback => assigned
2025-01-31 16:44 DenisChenu Note Added: 81931
2025-01-31 16:44 DenisChenu Bug heat 2 => 4
2025-01-31 16:46 DenisChenu Note Added: 81932
2026-10-08 18:22 c_schmitz Changeset attached => LimeSurvey master 84701db1
2026-10-08 18:22 c_schmitz Note Added: 86269
2026-10-08 18:22 c_schmitz Assigned To DenisChenu => c_schmitz
2026-10-08 18:22 c_schmitz Status assigned => resolved
2026-10-08 18:22 c_schmitz Resolution open => fixed
2026-10-08 18:22 c_schmitz Bug heat 4 => 6
2026-10-13 11:49 LimeBot Note Added: 86374
2026-10-13 11:49 LimeBot Status resolved => closed
2026-10-13 11:49 LimeBot Bug heat 6 => 8