Skip to content

Commit 328ef17

Browse files
authored
AAP-43543 - add details regarding case for LDAP usernames (#3312) (#3393)
* AAP-43453 - add details regarding case for LDAP usernames * AAP-43543 - implement SME review feedback * AAP43543 - added into regarding OAuth tokens * AAP-43543 - add SME review changes * AAP-43543 - add peer review changes
1 parent a42adcb commit 328ef17

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

downstream/modules/platform/proc-controller-set-up-LDAP.adoc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,15 @@ If the LDAP server you want to connect to has a certificate that is self-signed
1313

1414
When LDAP is configured, an account is created for any user who logs in with an LDAP username and password and they can be automatically placed into organizations as either regular users or organization administrators.
1515

16+
{PlatformNameShort} treats usernames as case-insensitive in LDAP. It sends the username that was entered without modification to the LDAP provider for authentication. After successful authentication, the platform converts the username to lowercase and stores it in the database. For example, if a user logs in as `JDOE`, their platform username will be `jdoe`. If the user logs in again as `JDoe`, their username will still be `jdoe`.
17+
18+
However, if {PlatformNameShort} is configured with multiple LDAP authenticators, and the same user IDs exist across them, their usernames might differ. For instance, `JDOE` might have the username `jdoe`, while `jDOE` could be assigned `jdoe-<some hash>`.
19+
20+
[NOTE]
21+
====
22+
If a user previously logged in using different case variations of their username, {PlatformNameShort} maps all case variations to the lowercase username. Existing users with other case variations are not valid for interactive log in. However, any existing OAuth tokens for the mixed case username still allow authentication. A system administrator can delete those case variation users if needed.
23+
====
24+
1625
Users created through an LDAP login should not change their username, first name, last name, or set a local password for themselves. Any changes made to this information is overwritten the next time the user logs in to the platform.
1726

1827
[IMPORTANT]

0 commit comments

Comments
 (0)