I think the severity of the bug should be higher

So, if the user has the the user name Foo in limesurvey and he logs in using 'foo' with LDP Auth what happens exactly?

It takes quite long and the login screen is reloaded and no error is shown.

(If the password is incorrect, an error is shown)

I have same problem in 3.17.1 (build 190408) .

The issue is more the no error ? No ?

Yeah, I think that the problem is the missing error message. I am bit skeptical about forcing uppercase/lowercase because it will certainly affect existing users.

No, in my opinion the problem is that LimeSurvey considers the the username case sensitive, when using LDAP. If you use internal database login that is not the case, you can write the username uppercase or lowercase or whataver.

By the way I don't know hardly any system that cares about case sensitivness considering the username.

Why should you force uppercase or lowercase? isn't this a database query where you can ignore the case?

And if you have :
One DB user with UserName and his password in DB with AuthDB true
One LDAP user with username and his another password and AuthDB+AuthLDAP true

… you have a security issue …

@halliball123: That is not true. THe interal DB admin login is also case-sensitive.

Username in database "user" and "USER" the same user (not case sensitive) but password will be case-sensitive
I only test it in LDAP login.

@c_schmitz: sorry, you are right. Was this always like that?

Non the less I don't think that usernames that are casesensitive are a good idea.

I know that this is standard in the linux/unix world. Windows and MacOS users who are using LimeSurvey backend are just not used to that.
I think you can configure that in your LDAP Server as well and .... .... ... of course it's your system and if nobody else has a problem with that ... ... then Dennis is right, there should be at least a message.

@dplazade: I am not sure what version you are using but the latest LimeSurvey version is case-sensitive regarding username.
For example if you have a user 'admin' you will not be able to log in with 'Admin' (and same password)

@c_schmitz
Sorry I meant me, I think it would be a good performance:

• login with internal DB, casesensitive
• login with LDAP, not casesensitive

Please, tell me what line I should change in my code. I will register the users always in uppercase for LDAP. I need that any login user (LDAP) always validates it in upper case.

In file: \application\core\plugins\AuthLDAP\AuthLDAP.php
I changed line 429:
$username = strtoupper($this->getUsername());
But I have same issue :)

Thanks!

You must do the search with SQL UCASE too :).

Good to know than we can not have 2 user with same login :) :+1:

Thanks @DenisChenu.

How? SQL UCASE? Where? In conditions?

In my database the table definition looks like users_name must be unique and collation is utf8mb4_unicode_ci
so there can't be two users that have the same username with different upper/lower case versions.

Therefore a call of touppercase or tolowercase before comparing usernames would not be a security issue, in my opinion.

Thanks @halliballi123 I will revise that :)

any news on this bug?

A PR is being discussed here: https://github.com/LimeSurvey/LimeSurvey/pull/1363

so no sollution?

The PR is obviously dead so unless someone invests time to code it (or money so that someone else codes it) this issue will stay open.

I'd like this feature too. When verifying LDAP usernames, the comparison is preferred to be case-insensitive.

My solution :

1. Add a option "Search with casesensitive" , uncheck by default (avoid security issue about User with AuthDB and LDAP) : some instance have only LDAP account and one DB account (initial superadmin)
2. Compare casesensitive if it's checked.

Yeah, I think that the problem is the missing error message. I am bit skeptical about forcing uppercase/lowercase because it will certainly affect existing users.

IN fact : we can not set username with uppercase or lowercase.

1. If you already have MyLogin, you can not create mylogin (manually via admin GUI) (tested on mariadb + MS sql server)
2. We manually check for AuthDB See https://github.com/LimeSurvey/LimeSurvey/blob/73ef7087b344ea55b44629ba596708e540d15838/application/core/plugins/Authdb/Authdb.php#L163

I didn't check with other way to create an user on MS SQL
Maybe it's better to force https://www.yiiframework.com/doc/api/1.1/CUniqueValidator#caseSensitive-detail to true ?

Tested on MSSQL + MARIADB + PGSQL, can not create 2 user with same login name and differnt case.
Maybe must be set clearly ?

@halliballi123 Can you test the following change, please? https://github.com/LimeSurvey/LimeSurvey/pull/2692/files

@ollehar, this is just great.
A oneliner that works like a charm ...

Tested in LimeSurvey 3.28.37+221108 and in LimeSurvey 5.6.0+230116
Works perfectly.
Thank you so much.

Thank Denis :)

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=34498

Fixed in Release 6.0.3+230424