From e1b9d361ed6d19ee261117a2e18860c6c99d1e20 Mon Sep 17 00:00:00 2001
From: Tomasz Torcz <tomek@pipebreaker.pl>
Date: Tue, 8 May 2018 11:47:23 +0200
Subject: [PATCH] case-insensitive LDAP group comparison (#9926)

* ldap: case-insensitive LDAP group comparison

According to RFC2251 4.1.5, LDAP strings are case-insensitive. Disregard case when comparing group mappings.

* ldap: add test for case-insensitive group mapping
---
 pkg/login/ldap_test.go | 14 ++++++++++++++
 pkg/login/ldap_user.go |  6 +++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/pkg/login/ldap_test.go b/pkg/login/ldap_test.go
index b8ef261c815..22959cb7e7f 100644
--- a/pkg/login/ldap_test.go
+++ b/pkg/login/ldap_test.go
@@ -53,6 +53,20 @@ func TestLdapAuther(t *testing.T) {
 			So(result, ShouldEqual, user1)
 		})
 
+		ldapAutherScenario("Given group match with different case", func(sc *scenarioContext) {
+			ldapAuther := NewLdapAuthenticator(&LdapServerConf{
+				LdapGroups: []*LdapGroupToOrgRole{
+					{GroupDN: "cn=users", OrgRole: "Admin"},
+				},
+			})
+
+			sc.userQueryReturns(user1)
+
+			result, err := ldapAuther.GetGrafanaUserFor(&LdapUserInfo{MemberOf: []string{"CN=users"}})
+			So(err, ShouldBeNil)
+			So(result, ShouldEqual, user1)
+		})
+
 		ldapAutherScenario("Given no existing grafana user", func(sc *scenarioContext) {
 			ldapAuther := NewLdapAuthenticator(&LdapServerConf{
 				LdapGroups: []*LdapGroupToOrgRole{
diff --git a/pkg/login/ldap_user.go b/pkg/login/ldap_user.go
index 9f1cf3c96b6..3651d9e5e23 100644
--- a/pkg/login/ldap_user.go
+++ b/pkg/login/ldap_user.go
@@ -1,5 +1,9 @@
 package login
 
+import (
+	"strings"
+)
+
 type LdapUserInfo struct {
 	DN        string
 	FirstName string
@@ -15,7 +19,7 @@ func (u *LdapUserInfo) isMemberOf(group string) bool {
 	}
 
 	for _, member := range u.MemberOf {
-		if member == group {
+		if strings.EqualFold(member, group) {
 			return true
 		}
 	}