uid
or mail
) for the user name that is
specified to be case insensitive. Unless you are connecting to a LDAP server that uses a different search attribute
than the defaults you should leave this as Case insensitive
.
Recommendations:
uid={0}
then select Case insensitive
.mail={0}
then select Case insensitive
.Case insensitive
being the best choice for the lazy.
Note:
If you are using an email address attribute for theĀ user search you will want to ask the mail server administrator whether they have case sensitive mailboxes. RFC 2821 Section 2.4 specifies:The local-part of a mailbox MUST BE treated as case sensitive. Therefore, SMTP implementations MUST take care to preserve the case of mailbox local-parts. Mailbox domains are not case sensitive.This is in conflict with the case sensitivity rules for the standard LDAP attribute used to hold email addresses (caseIgnoreIA5Match
, e.g. as noted in RFC 2798So when the user search filter is( 0.9.2342.19200300.100.1.3 NAME 'mail' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )Note: RFC 1274 uses the longer name 'rfc822Mailbox
' and syntax OID of0.9.2342.19200300.100.3.5
. All recent LDAP documents and most deployed LDAP implementations refer to this attribute as '1.3.6.1.4.1.1466.115.121.1.26
, as is done here.mail={0}
it is pointless to select anything other thanCase insensitive
as the LDAP server will be ignoring case when searching anyway.
If you do need to select a case sensitive strategy because you are searching on a custom attribute you should note that theCase sensitive (email address)
strategy applies RFC 2821's rules on case sensitivity (i.e. the local-part is case sensitive and the mailbox domain is case insensitive), thus with that strategyJOE@ACME.COM
andJOE@acme.com
will be considered the same Jenkins user whilejoe@acme.com
will be considered as a different Jenkins user.
Note: UNIX login names are case sensitive