Re: [PATCH] Case insensitive username matching for WIN32 and BS2000 (and OS2?)

[Guenter Knauf <fu...@apache.org>]

Hi Martin,
> The usernames in WIN32 are, IIRC , case insensitive (and they are in
> BS2000, and perhaps in OS2?).
when authenticating against system accounts then NetWare is insensitive too.

> Some of the username auth code uses tables, and thus case insensitive
> matching, but at some places, user names are compared literally.

> The appended patch tries to make these literal comparisons
> case insensitive, too, by using strcasecmp() in place of strcmp().
just a thought: 
if we would create a new API like ap_cmp_username() we could use a
configure flag like AuthCmpUserCaseInSensitive, and let the user self
control the behavior instead of having it hardcoded platform-dependent;
f.e. I think that if you use file-based auth on Win32 why shouldnt that
be case-sensitive if the user wants that?
Or am I missing something here?

Guenter.

Re: [PATCH] Case insensitive username matching for WIN32 and BS2000 (and OS2?)

[Martin Kraemer <ma...@apache.org>]

On Tue, Dec 04, 2007 at 05:54:16PM +0100, Guenter Knauf wrote:
> f.e. I think that if you use file-based auth on Win32 why shouldnt that
> be case-sensitive if the user wants that?

You are right for the dbm or file-based auth. But I was thinking of,
e.g., the
  Require file-owner hugo
requirement, and that should result in a case insensitive comparison
on systems with case insensitive "login" names. In Unix, case matters,
while in Windows, it doesn't.

   Martin
-- 
<Ma...@Fujitsu-Siemens.com>        |     Fujitsu Siemens
http://www.fujitsu-siemens.com/imprint.html | 81730  Munich,  Germany

Re: [PATCH] Case insensitive username matching for WIN32 and BS2000 (and OS2?)

[Jeff Trawick <tr...@gmail.com>]

On Dec 4, 2007 11:54 AM, Guenter Knauf <fu...@apache.org> wrote:
> Hi Martin,
> > The usernames in WIN32 are, IIRC , case insensitive (and they are in
> > BS2000, and perhaps in OS2?).
> when authenticating against system accounts then NetWare is insensitive too.
>
> > Some of the username auth code uses tables, and thus case insensitive
> > matching, but at some places, user names are compared literally.
>
> > The appended patch tries to make these literal comparisons
> > case insensitive, too, by using strcasecmp() in place of strcmp().
> just a thought:
> if we would create a new API like ap_cmp_username() we could use a
> configure flag like AuthCmpUserCaseInSensitive, and let the user self
> control the behavior instead of having it hardcoded platform-dependent;
> f.e. I think that if you use file-based auth on Win32 why shouldnt that
> be case-sensitive if the user wants that?
> Or am I missing something here?

FWIW, z/OS "system" accounts are case insensitive too, and an auth
module which checks the system account database needs to perform case
insignificant comparisons just like telnetd or other servers would.

But I like the idea that these non-system-account auth modules perform
the same type of comparison on all platforms, and the administrator
anywhere could opt for case-insignificant comparisons where
appropriate.