From c59cc8c9d33ce291ab13369b6eb9b151a60eb20b Mon Sep 17 00:00:00 2001
From: mdecimus <11444311+mdecimus@users.noreply.github.com>
Date: Thu, 18 Dec 2025 15:12:41 +0100
Subject: [PATCH] Lowercase LDAP attribute comparison - credits to @pdf (fixes
 #2363 closes #2378)

---
 crates/directory/src/backend/ldap/config.rs | 20 ++++++++++----------
 crates/directory/src/backend/ldap/lookup.rs | 12 ++++++------
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/crates/directory/src/backend/ldap/config.rs b/crates/directory/src/backend/ldap/config.rs
index 41ebf33d..ab9267d9 100644
--- a/crates/directory/src/backend/ldap/config.rs
+++ b/crates/directory/src/backend/ldap/config.rs
@@ -56,41 +56,41 @@ impl LdapDirectory {
             filter_email: LdapFilter::from_config(config, (&prefix, "filter.email")),
             attr_name: config
                 .values((&prefix, "attributes.name"))
-                .map(|(_, v)| v.to_string())
+                .map(|(_, v)| v.to_lowercase())
                 .collect(),
             attr_groups: config
                 .values((&prefix, "attributes.groups"))
-                .map(|(_, v)| v.to_string())
+                .map(|(_, v)| v.to_lowercase())
                 .collect(),
             attr_type: config
                 .values((&prefix, "attributes.class"))
-                .map(|(_, v)| v.to_string())
+                .map(|(_, v)| v.to_lowercase())
                 .collect(),
             attr_description: config
                 .values((&prefix, "attributes.description"))
-                .map(|(_, v)| v.to_string())
+                .map(|(_, v)| v.to_lowercase())
                 .collect(),
             attr_secret: config
                 .values((&prefix, "attributes.secret"))
-                .map(|(_, v)| v.to_string())
+                .map(|(_, v)| v.to_lowercase())
                 .collect(),
             attr_secret_changed: config
                 .values((&prefix, "attributes.secret-changed"))
-                .map(|(_, v)| v.to_string())
+                .map(|(_, v)| v.to_lowercase())
                 .collect(),
             attr_email_address: config
                 .values((&prefix, "attributes.email"))
-                .map(|(_, v)| v.to_string())
+                .map(|(_, v)| v.to_lowercase())
                 .collect(),
             attr_quota: config
                 .values((&prefix, "attributes.quota"))
-                .map(|(_, v)| v.to_string())
+                .map(|(_, v)| v.to_lowercase())
                 .collect(),
             attr_email_alias: config
                 .values((&prefix, "attributes.email-alias"))
-                .map(|(_, v)| v.to_string())
+                .map(|(_, v)| v.to_lowercase())
                 .collect(),
-            attrs_principal: vec!["objectClass".to_string()],
+            attrs_principal: vec!["objectClass".to_lowercase()],
         };
 
         for attr in [
diff --git a/crates/directory/src/backend/ldap/lookup.rs b/crates/directory/src/backend/ldap/lookup.rs
index 956678b9..b2a5fa1e 100644
--- a/crates/directory/src/backend/ldap/lookup.rs
+++ b/crates/directory/src/backend/ldap/lookup.rs
@@ -228,7 +228,7 @@ impl LdapDirectory {
                         .map_err(|err| err.into_error().caused_by(trc::location!()))?;
                     for entry in rs {
                         'outer: for (attr, value) in SearchEntry::construct(entry).attrs {
-                            if self.mappings.attr_name.contains(&attr)
+                            if self.mappings.attr_name.contains(&attr.to_lowercase())
                                 && let Some(group) = value.into_iter().next()
                                 && !group.is_empty()
                             {
@@ -310,14 +310,13 @@ impl LdapDirectory {
         );
 
         for entry in rs {
-            let entry = SearchEntry::construct(entry);
-            for attr in &self.mappings.attr_name {
-                if let Some(name) = entry.attrs.get(attr).and_then(|v| v.first())
-                    && !name.is_empty()
+            for (attr, value) in SearchEntry::construct(entry).attrs {
+                if self.mappings.attr_name.contains(&attr.to_lowercase())
+                    && let Some(name) = value.into_iter().find(|name| !name.is_empty())
                 {
                     return self
                         .data_store
-                        .get_or_create_principal_id(name, Type::Individual)
+                        .get_or_create_principal_id(&name, Type::Individual)
                         .await
                         .map(Some);
                 }
@@ -436,6 +435,7 @@ impl LdapMappings {
         let mut email_aliases = Vec::new();
 
         for (attr, value) in entry.attrs {
+            let attr = attr.to_lowercase();
             if self.attr_name.contains(&attr) {
                 if !self.attr_email_address.contains(&attr) {
                     principal.name = value.into_iter().next().unwrap_or_default();