diff --git a/src/main/java/de/thm/arsnova/security/CustomLdapUserDetailsMapper.java b/src/main/java/de/thm/arsnova/security/CustomLdapUserDetailsMapper.java index 13339d0a11a3edc0389ad8768f49b8c071dacb26..a67c3999eb10e6a4d71694216d33d1c5f79167c9 100644 --- a/src/main/java/de/thm/arsnova/security/CustomLdapUserDetailsMapper.java +++ b/src/main/java/de/thm/arsnova/security/CustomLdapUserDetailsMapper.java @@ -26,8 +26,8 @@ public class CustomLdapUserDetailsMapper extends LdapUserDetailsMapper { Collection<? extends GrantedAuthority> authorities) { String ldapUsername = ctx.getStringAttribute(userIdAttr); if (ldapUsername == null) { - LOGGER.warn("LDAP attribute {} not set. Falling back to user provided username.", userIdAttr); - ldapUsername = username; + LOGGER.warn("LDAP attribute {} not set. Falling back to lowercased user provided username.", userIdAttr); + ldapUsername = username.toLowerCase(); } UserDetails userDetails = super.mapUserFromContext(ctx, ldapUsername, authorities); diff --git a/src/main/java/de/thm/arsnova/security/DbUserDetailsService.java b/src/main/java/de/thm/arsnova/security/DbUserDetailsService.java index 52809a486ccae90a4d5046f87fbba579badefa0a..8df0968069c89ae5809c38df585a9a8fff5caeef 100644 --- a/src/main/java/de/thm/arsnova/security/DbUserDetailsService.java +++ b/src/main/java/de/thm/arsnova/security/DbUserDetailsService.java @@ -46,8 +46,9 @@ public class DbUserDetailsService implements UserDetailsService { @Override public UserDetails loadUserByUsername(String username) { - LOGGER.debug("Load user: " + username); - DbUser dbUser = dao.getUser(username); + String uid = username.toLowerCase(); + LOGGER.debug("Load user: " + uid); + DbUser dbUser = dao.getUser(uid); if (null == dbUser) { throw new UsernameNotFoundException("User does not exist."); } @@ -56,7 +57,7 @@ public class DbUserDetailsService implements UserDetailsService { grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_USER")); grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_DB_USER")); - return new User(username, dbUser.getPassword(), + return new User(uid, dbUser.getPassword(), null == dbUser.getActivationKey(), true, true, true, grantedAuthorities); } diff --git a/src/main/java/de/thm/arsnova/services/UserService.java b/src/main/java/de/thm/arsnova/services/UserService.java index 7b1fa751189784f5cda04dfe01a33f12b1616b60..26ca91227ec6e5f7a48f5311650246b937b03665 100644 --- a/src/main/java/de/thm/arsnova/services/UserService.java +++ b/src/main/java/de/thm/arsnova/services/UserService.java @@ -327,11 +327,13 @@ public class UserService implements IUserService { @Override public DbUser getDbUser(String username) { - return databaseDao.getUser(username); + return databaseDao.getUser(username.toLowerCase()); } @Override public DbUser createDbUser(String username, String password) { + String lcUsername = username.toLowerCase(); + if (null == keygen) { keygen = KeyGenerators.secureRandom(32); } @@ -340,16 +342,16 @@ public class UserService implements IUserService { parseMailAddressPattern(); } - if (null == mailPattern || !mailPattern.matcher(username).matches()) { + if (null == mailPattern || !mailPattern.matcher(lcUsername).matches()) { return null; } - if (null != databaseDao.getUser(username)) { + if (null != databaseDao.getUser(lcUsername)) { return null; } DbUser dbUser = new DbUser(); - dbUser.setUsername(username); + dbUser.setUsername(lcUsername); dbUser.setPassword(encodePassword(password)); dbUser.setActivationKey(RandomStringUtils.randomAlphanumeric(32)); dbUser.setCreation(System.currentTimeMillis()); @@ -425,13 +427,13 @@ public class UserService implements IUserService { @Override public DbUser deleteDbUser(String username) { User user = getCurrentUser(); - if (!user.getUsername().equals(username) + if (!user.getUsername().equals(username.toLowerCase()) && !SecurityContextHolder.getContext().getAuthentication().getAuthorities() .contains(new SimpleGrantedAuthority("ROLE_ADMIN"))) { throw new UnauthorizedException(); } - DbUser dbUser = databaseDao.getUser(username); + DbUser dbUser = getDbUser(username); if (null == dbUser) { throw new NotFoundException(); } @@ -443,7 +445,7 @@ public class UserService implements IUserService { @Override public void initiatePasswordReset(String username) { - DbUser dbUser = databaseDao.getUser(username); + DbUser dbUser = getDbUser(username); if (null == dbUser) { throw new NotFoundException(); }