User uid does not match as it is interpreted case sensistive

[mpibpc-mroose]

Given I have my NextCloud configured with LDAP Authentication and want to provide additional SAML authentication provided by KeyCloak. In the default configuration LDAP usese the objectGUID of LDAP as username and stores it uppercase.

KeyCloak on the other side stores that ID in lower case and there seems to be no possibility to deliver that as upper case SAML attribute.

So there is no possibility "to match" users from LDAP and SAML:

Is there any possibility to make the UID matching case insensitive?

[blizzz]

user IDs are case sensitive in Nextcloud. The SP config has to ensure the matching value is being passed to Nextcloud.

[tgurr]

@mpibpc-mroose Have you ever been able to find a solution for that? I'm running into the same issue when trying to use Keycloak in combination with Active Directory. I have no attribute not running into the problem with, nothing works due to Nextcloud being case sensitive, UUID, sAMAccountName, userPrincipalName, mail, ...

[cluck]

Not exactly pertinent to OP's issue, but sharing the same root limitation: if you're using user_saml to enable Kerberos/NEGOTIATE login, you may find yourself in the position that Nextcloud derives uppercase user_ids from LDAP objectGUID, while the uniqueID retrieved from SSSD via Apache's LookupUserAttr is lowercase.

You'll be able to convert the lowercase uniqueID to uppercase using ProxyFCGISetEnvIf:

<Location "/apps/user_saml/saml/login">
    <IfModule mod_auth_gssapi.c>
       LookupUserAttr uniqueID REMOTE_USER_USERID " "
   </IfModule>
</Location>
ProxyFCGISetEnvIf "toupper(reqenv('REDIRECT_REMOTE_USER_USERID')) =~ m|(.+)|" REDIRECT_REMOTE_USER_USERID_UCASE "$1"

Then you'll need to point user_saml to read REDIRECT_REMOTE_USER_USERID_UCASE as "uid".

Maybe the same can be used to work around nextcloud/server#44486

[Kurg4ch]

Hello everyone, has anyone found a solution to this problem?

[tgurr]

Hello everyone, has anyone found a solution to this problem?

@Kurg4ch Not a solution but a workaround implemented on the Keycloak side via JavaScript to transform the lowercase item (LDAP_ID/UUID in this case) to uppercase to allow things to match, see keycloak/keycloak#15312 for details. Still having to live with this hack to this date.