Should username claim be case insensitive?

[vineetnair]

Great work with this project guys! So useful :)

I noticed the username-based claim failed a couple of times for us due to case-sensitivity reasons. Should this check be done case-insensitively?

[Konstantin Lepeshenkov]

Thanks for your feedback, @vineetnair .

Are you saying that the same username sometimes appears in e.g. lower case and sometimes in upper case in your tokens?

[vineetnair]

No, the username claim via the token just retains the casing in which it was setup in AAD. But the configuration in DFM to only allow certain users seems to have a case-sensitive checking.

So, if the claim is [e-mail] and the allowed username is [e-mail], it doesn't allow access and throws a 401.

[Konstantin Lepeshenkov]

Then I'd suggest to stay on the safe side and keep this validation case-sensitive. At least, so long as it doesn't block any particular scenario.

[vineetnair]

That's fair, thanks