Re: [ldapext] Case sensitivity of user/group names (was Re: DBIS commentary)

[Charlie <[e-mail]>]

On Thu, Dec 3, 2015 at 6:02 PM, Jordan Brown <[e-mail]> wrote:
> On 12/3/2015 2:45 PM, Charlie wrote:
>>
>> Well, in a cleanly integrated environment, I'd expect to see most
>> users' Microsoft SamAccountName and POSIX uid be identical lower-cased
>> strings less than 20 characters long.  I believe all currently
>> shipping LDAP directory implementations support the necessary schema.
>> Certainly AD and OpenLDAP both do.
>>
>> SamAccountName should be case-insensitive, uid should be
>> case-sensitive.
>
> If sAMAccountName and uid are identical, and sAMAccountName is
> case-insensitive, doesn't that mean that you can't have two users whose
> 'uid' differs only in case?

I think you missed the word "most"?   Normal user accounts being
created today would be unlikely to differ from each other only in
case.  Just old stuff and unique hacks.

> It would seem that the only visible effect of such a configuration is that
> an attempt to look up a wrong-case name on UNIX would fail, which is
> compatible in some sense but doesn't seem to really add any value over
> case-insensitivity.

I see compatibility with published standards and system documentation
as being vastly more valuable than catering to typing mistakes, but
obviously that's just my opinion.

More importantly, *nix tools and system utilities are going to make
case-sensitive comparisons of usernames internally, so if your name
service daemons aren't case-sensitive as well, *nix-based systems are
likely to be subtly broken.  Comparisons aren't restricted to the LDAP
service host, they happen on the local OS too - including in
site-developed code that was built to documented standards.

--Charlie