Thread: Case insensitive usernames

Today, usernames are case sensitive. This can cause some problems in for
example a kerberos environment (such as a Windows domain, in my case),
because the system usernames are case insensitive. So if I log in to my
workstation as "Maghag" I cannot connect to postgresql, because my
postgresql username is "maghag".

I would like to see a GUC variable to enable case insensitive usernames.
Would a patch for such a thing be accepted? (or if the functionality
alraedy exists, a pointer would be much appreciated)

//Magnus

"Magnus Hagander" <mha@sollentuna.net> writes:
> I would like to see a GUC variable to enable case insensitive usernames.
> Would a patch for such a thing be accepted?

No, not any more than it would be for any other SQL identifiers.  See
(many, many) past threads.
        regards, tom lane

>> I would like to see a GUC variable to enable case
>insensitive usernames.
>> Would a patch for such a thing be accepted?
>
>No, not any more than it would be for any other SQL identifiers.  See
>(many, many) past threads.

Yes, I've seen the many past threads on that ;-) I figured it might be
acceptable for just usernames.

Not sure if it's worth it ;-), but perhaps I should clearify what I
mean. I don't actually mean "case insensitive usernames". I mean
case-folding the username to lowercase once it has been received on the
server. Not sure if that makes a difference for you, but at least now
I've explained what I really meant.

Another way to help in this particular case would be to have libpq on
win32 only force-lowercase the username IF it was retreived from the
system (but not when manually specified). Then if this was done the
kerberos username-matching code would just have to be relaxed to be case
insensitive (which it really should be, because AFAIK kerberos is
supposed to be case insensitive), and the system itself can stay case
sensitive. (I still think a generic solution would be better, but this
would solve *my* problems and those of a couple of others I've heard of
who are running on win32)

Would this be acceptable instead?


//Magnus

"Magnus Hagander" <mha@sollentuna.net> writes:
> Another way to help in this particular case would be to have libpq on
> win32 only force-lowercase the username IF it was retreived from the
> system (but not when manually specified).

Well, I personally don't care how bizarrely the Win32 port behaves ;-)
so I won't complain if something like that happens.  You should think
twice though about whether introducing this inconsistency is going to
be a net win, or whether it'll just move the confusion someplace else.

> Then if this was done the
> kerberos username-matching code would just have to be relaxed to be case
> insensitive (which it really should be, because AFAIK kerberos is
> supposed to be case insensitive),

This however bothers me; it seems like a potential security hole (create
kerberos principal FOO, use it to break into Foo's account).  Or does
kerberos guarantee FOO and Foo are the same?
        regards, tom lane

> > Another way to help in this particular case would be to
> have libpq on
> > win32 only force-lowercase the username IF it was retreived
> from the
> > system (but not when manually specified).
>
> Well, I personally don't care how bizarrely the Win32 port
> behaves ;-) so I won't complain if something like that
> happens.  You should think twice though about whether
> introducing this inconsistency is going to be a net win, or
> whether it'll just move the confusion someplace else.

Windows is case-insensitive to usernames. Always has been, and I really
don't think it's about to change considering M$'s deal with backwards
compatiblity. I doubt if this would surprise anybody - at least anybody
on the win32 platform.

Actualyl, what usually surprises people is that GetUserName() returns
the case of the username *as the user entered it at login*, and *NOT* as
the administrator entered it in the Active Directory. Which can be said
to be a bug depending on how you look at it, but from a "username is
case insensitive" perspective it doesn't matter.

Note that we wouldn't case-change a userid that is actually specified by
the user (in the connectino string, on the commandline to psql).


> > Then if this was done the
> > kerberos username-matching code would just have to be relaxed to be
> > case insensitive (which it really should be, because AFAIK
> kerberos is
> > supposed to be case insensitive),
>
> This however bothers me; it seems like a potential security
> hole (create kerberos principal FOO, use it to break into
> Foo's account).

Actually, to be specific, if you case-fold it he could get into "foo"
but not "Foo".

> Or does kerberos guarantee FOO and Foo are the same?

Did some further checking, and it turns out this depends on the KDC. All
KDCs are required to be case sensitive no the *REALM*. But I can't find
any documented requirements on the principal - just signs that different
KDCs treat it differently. Windows AD KDC for example is insensitive,
whereas I think it looks like MIT is case sensitive.

Which brings me back to thinking a GUC is the way to deal with that -
you'll definitly know what kind of KDC you have when you set up
Kerberos. But perhaps this GUC should be for "permit case-insensitive
kerberos principals" and not "case-insensitive usernames". And it would
just control the comparison between kerberos principal and user-supplied
username. The user-supplied username would still be what's used in any
access to the database, regardless of case.

Reasonable?


//Magnus

"Magnus Hagander" <mha@sollentuna.net> writes:
> Which brings me back to thinking a GUC is the way to deal with that -
> you'll definitly know what kind of KDC you have when you set up
> Kerberos. But perhaps this GUC should be for "permit case-insensitive
> kerberos principals" and not "case-insensitive usernames". And it would
> just control the comparison between kerberos principal and user-supplied
> username. The user-supplied username would still be what's used in any
> access to the database, regardless of case.

That would work for me as long as the default is case-sensitive; the
other seems too likely to be a security hazard.  (And it had better be
documented that way, too: "DO NOT turn this on unless you are certain
you are using a case-insensitive KDC.")

What will we call the GUC?  kerberos_case_insensitive_principals
seems a bit, um, verbose.
        regards, tom lane

> > Which brings me back to thinking a GUC is the way to deal
> with that -
> > you'll definitly know what kind of KDC you have when you set up
> > Kerberos. But perhaps this GUC should be for "permit
> case-insensitive
> > kerberos principals" and not "case-insensitive usernames". And it
> > would just control the comparison between kerberos principal and
> > user-supplied username. The user-supplied username would still be
> > what's used in any access to the database, regardless of case.
>
> That would work for me as long as the default is
> case-sensitive; the other seems too likely to be a security
> hazard.  (And it had better be documented that way, too: "DO
> NOT turn this on unless you are certain you are using a
> case-insensitive KDC.")

Fine with me - you'll need to tweak the default principal name anyway to
work with the windwos KDC, so you're giong there anyawy. It's just a
matter of documenting it.


> What will we call the GUC?  kerberos_case_insensitive_principals
> seems a bit, um, verbose.
All other kerberos parameters are krb_ and not kerberos_, so that saves
a bit :) How about just "krb_case_insensitive"? Or "krb_case_ins_princ"?

//Magnus