refactor: lowercase email address search to match keycloak #3847
+49
−36
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
General Checklist
Database Migrations
Creating a user in Lagoon with an uppercase email address ends up with Keycloak saving/storing it as lowercase. If a user then tries to query Lagoon for this user using the uppercase email, the Keycloak lookup fails because it does not match the lowercase saved email.
Keycloak saves all email addresses and usernames as lowercase when users are created, even if the provided email address contains uppercase. Confusingly though, it still respects case sensitivity in the API query params when doing lookups. It appears Keycloak have chosen to do this for some reason, probably for consistency, and there isn't any feature or parameter to change this behaviour.
There are numerous github issues and stack overflow posts where people have encountered issues with needing uppercase usernames or email address in Keycloak with no real clear indication if it can be changed.
While the mailbox local part of an email address should be case sensitive per RFC 5321 2.3.11 and 2.4, however, the majority of email service providers will ignore this to reduce confusion. For example,
[email protected]
and[email protected]
according to RFC should be treated as different mailboxes.The simplest solution for us is to just make sure we lowercase email addresses when we're performing user lookups against Keycloak, which is what this pull request does.
Additionally, I've renamed some of the user lookup functions to better suit their use, and also updated the
allUser
query to be more efficient when filtering on an email address or user ID by only looking up the requested filter query.