necouchman commented on PR #1028: URL: https://github.com/apache/guacamole-client/pull/1028#issuecomment-2449699263
> I think we do need to switch over to the monolithic enable/disable option (and +1 on the 😩). > > As I review, I'm running into things like handling of usernames within history records, and there doesn't seem to be any way we can handle differences in case sensitivity sanely unless there is only the platform-wide option that states how all usernames are to be interpreted. > > For example, let's say there are two authentication systems installed: > > 1. LDAP (configured to be case-insensitive) > 2. PostgreSQL (configured to be case-sensitive) > > If a user `SOMEONE` logs in with LDAP and accesses a connection, and then a user `someone` logs into PostgreSQL and accesses another connection, are they the same user? If a group in PostgreSQL includes the PostgreSQL user `someone`, does that include the LDAP user `SOMEONE`? > > With a platform-wide option, things are completely unambiguous and everything is in agreement. With extension-specific options, things make sense as long as everything is manually configured to be in agreement, but stop making sense once there is any disagreement between extensions. Okay, I'll switch it up and go that route. It pains me a little bit to take away the flexibility of being able to choose on a per-extension basis, but the example you give above highlights the challenges with even making that available and the confusion that might arise were someone to try to debug that sort of situation. The other thing that has continued to nag at the back of my mind is that I think we (ultimately) need to make the same option available for group names. This effort has focused almost exclusively on usernames, but I cannot help but think that the expectation of making _usernames_ case-insensitive is going to easily make someone think that _group names_ also ought to be case-insensitive. Thoughts on expanding the scope from just `User` objects to include `UserGroup` objects in this? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: dev-unsubscr...@guacamole.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
