From dc5f86c40c406710a3c00741e55596e9d2b07da7 Mon Sep 17 00:00:00 2001
From: Ruslan Musaev <43766501+HocKu7@users.noreply.github.com>
Date: Fri, 21 Nov 2025 09:23:28 +0100
Subject: [PATCH] Dbeaver/pro#7192 ldap case insensitivity (#3907)

* dbeaver/pro#7192 ldap case insensitivity

* dbeaver/pro#7192 ldap case-insensitive matching

* dbeaver/pro#7192 case insensitive from auth descriptor

---------

Co-authored-by: Evgenia <139753579+EvgeniaBzzz@users.noreply.github.com>
---
 .../service/ldap/auth/LdapAuthProvider.java   |  4 ++--
 .../CBEmbeddedSecurityController.java         | 19 ++++++++++++++++---
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java b/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java
index 01ef4303ba..9c1d364b14 100644
--- a/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java
+++ b/server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java
@@ -418,10 +418,10 @@ public class LdapAuthProvider implements SMAuthProviderExternal<SMSession>, SMBr
     private String buildFullUserDN(String userName, LdapSettings ldapSettings) {
         String fullUserDN = userName;
 
-        if (!fullUserDN.startsWith(ldapSettings.getUserIdentifierAttr())) {
+        if (!CommonUtils.startsWithIgnoreCase(fullUserDN, ldapSettings.getUserIdentifierAttr())) {
             fullUserDN = String.join("=", ldapSettings.getUserIdentifierAttr(), userName);
         }
-        if (CommonUtils.isNotEmpty(ldapSettings.getBaseDN()) && !fullUserDN.endsWith(ldapSettings.getBaseDN())) {
+        if (CommonUtils.isNotEmpty(ldapSettings.getBaseDN()) && !CommonUtils.endsWithIgnoreCase(fullUserDN, ldapSettings.getBaseDN())) {
             fullUserDN = String.join(",", fullUserDN, ldapSettings.getBaseDN());
         }
 
diff --git a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
index a0a34fcee1..1fc58e69fc 100644
--- a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
+++ b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
@@ -2577,7 +2577,8 @@ public class CBEmbeddedSecurityController<T extends ServletAuthApplication>
                 .flatMap(externalTeamId -> findTeamByExternalTeamId(
                     allTeams,
                     externalTeamIdMetadataFieldName,
-                    externalTeamId
+                    externalTeamId,
+                    authProvider.isCaseInsensitive()
                 ).stream())
                 .map(SMTeam::getTeamId)
                 .toArray(String[]::new);
@@ -2614,17 +2615,29 @@ public class CBEmbeddedSecurityController<T extends ServletAuthApplication>
     }
 
     @NotNull
-    private List<SMTeam> findTeamByExternalTeamId(SMTeam[] allTeams, String externalGroupParameterName, String groupId) {
+    private List<SMTeam> findTeamByExternalTeamId(
+        SMTeam[] allTeams,
+        String externalGroupParameterName,
+        String groupId,
+        boolean isCaseInsensitive
+    ) {
         List<SMTeam> result = new ArrayList<>();
         for (SMTeam team : allTeams) {
             String teamGroupId = team.getMetaParameters().get(externalGroupParameterName);
-            if (CommonUtils.equalObjects(teamGroupId, groupId)) {
+            if (matchesGroupId(teamGroupId, groupId, isCaseInsensitive)) {
                 result.add(team);
             }
         }
         return result;
     }
 
+    private boolean matchesGroupId(String teamGroupId, String groupId, boolean isCaseInsensitive) {
+        if (isCaseInsensitive) {
+            return teamGroupId != null && teamGroupId.equalsIgnoreCase(groupId);
+        }
+        return CommonUtils.equalObjects(teamGroupId, groupId);
+    }
+
 
     private String readProviderConfigId(String authAttemptId, String authProviderId) throws DBException {
         try (Connection dbCon = database.openConnection()) {