Fix handling of lowercase HTTP username

When Gerrit config auth.userNameToLowerCase is set to true
we need to convert the HTTP-provided username to lowercase
as it is done on all the other authentication mechanism.

Problem has been reported on version 2.12 but it seemed to
be in the codebase since the beginning (see [1]).

[1] https://groups.google.com/forum/#!topic/repo-discuss/spxE88RiDfo

Change-Id: If4398bc959ee10e631149e96db05d272634d62ce
Reported-By: Steffen Gebert <steffen@steffen-gebert.de>

1 files changed, 5 insertions, 1 deletions

diff --git a/gerrit-httpd/src/main/java/com/google/gerrit/httpd/auth/container/HttpAuthFilter.java b/gerrit-httpd/src/main/java/com/google/gerrit/httpd/auth/container/HttpAuthFilter.java
index 949f392e32..38382aa961 100644
--- a/gerrit-httpd/src/main/java/com/google/gerrit/httpd/auth/container/HttpAuthFilter.java
+++ b/gerrit-httpd/src/main/java/com/google/gerrit/httpd/auth/container/HttpAuthFilter.java
@@ -34,6 +34,7 @@ import com.google.inject.Singleton;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.util.Locale;
 
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
@@ -63,6 +64,7 @@ class HttpAuthFilter implements Filter {
   private final String displaynameHeader;
   private final String emailHeader;
   private final String externalIdHeader;
+  private final boolean userNameToLowerCase;
 
   @Inject
   HttpAuthFilter(final DynamicItem<WebSession> webSession,
@@ -83,6 +85,7 @@ class HttpAuthFilter implements Filter {
     displaynameHeader = emptyToNull(authConfig.getHttpDisplaynameHeader());
     emailHeader = emptyToNull(authConfig.getHttpEmailHeader());
     externalIdHeader = emptyToNull(authConfig.getHttpExternalIdHeader());
+    userNameToLowerCase = authConfig.isUserNameToLowerCase();
   }
 
   @Override
@@ -136,7 +139,8 @@ class HttpAuthFilter implements Filter {
   }
 
   String getRemoteUser(HttpServletRequest req) {
-    return RemoteUserUtil.getRemoteUser(req, loginHeader);
+    String remoteUser = RemoteUserUtil.getRemoteUser(req, loginHeader);
+    return userNameToLowerCase ? remoteUser.toLowerCase(Locale.US) : remoteUser;
   }
 
   String getRemoteDisplayname(HttpServletRequest req) {