Possible to set case insensitive for LDAP lookup?

[deleted]

I am using LDAP UPN for sign in and some users have a capital first letter in their UPN, some do not. If they type it incorrectly it fails because of the mismatch. Is it possible to sign in using either case?

openvpn_inc

Hello stech4114,

It is up to the LDAP server to deal with case insensitive behavior. On Windows AD servers for example it is quite common that any case is accepted.

Kind regards,
Johan

[deleted]

openvpn_inc wrote Hello stech4114,

It is up to the LDAP server to deal with case insensitive behavior. On Windows AD servers for example it is quite common that any case is accepted.

Kind regards,
Johan

That's not the "case" here 😉 from the OpenVPN log this is what happens... also I want to note you can sign into the web portal with EITHER case... but with the OpenVPN Connect client you must use the proper case:

username-only match fail, client username='Thisuser@domain.ext', DB username='thisuser@domain.ext '

[deleted]

Any help on this? the error seems to be that openvpn server cares about it not the LDAP server... it even finishes DUO auth before giving the error:

username-only match fail, client username='Thisuser@domain.ext', DB username='thisuser@domain.ext '

openvpn_inc

Hello,

I see, there is also Duo post-auth script involved. That might be a case where the normal logic doesn't work as well.

There is an option under Authentication > LDAP to make authentication case insensitive but not sure if that works in combination with Duo.

You may need to contact our support and send information on how things are setup, there may be a case here where case insensitive behavior is simply not possible due to the interaction between Access Server, LDAP, and Duo script. We might then make an internal case to see what could be done. Without Duo script, Access Server sends the credentials to the LDAP server, and the LDAP server then decides to verify that case-sensitive or not. The LDAP then sends back the exact case as it is in the LDAP directory, and then the Access Server sticks to using that for authentication. But with Duo being inbetween, that might upset that. The Duo script may be specifically taking the user input and ignore what the LDAP server reports back, resulting in a possible mismatch in case.

You might want to consider switching to Duo SAML implementation, if possible.

Kind regards,
Johan