fix: lower-case remote usernames before validation

Fixes a bug where users are saved lowercase but compared mixed-case. Only applies to upstreams that send non-lowercase usernames. No obvious security impact; it results in a unique key violation and not a successful login.

1 files changed, 1 insertions, 1 deletions

diff --git a/plugins/auth_remote/init.php b/plugins/auth_remote/init.php
index 3203d41fe..2fb45fdef 100644
--- a/plugins/auth_remote/init.php
+++ b/plugins/auth_remote/init.php
@@ -45,7 +45,7 @@ class Auth_Remote extends Auth_Base {
 
 		foreach (["REMOTE_USER", "HTTP_REMOTE_USER", "REDIRECT_REMOTE_USER", "PHP_AUTH_USER"] as $hdr) {
 			if (!empty($_SERVER[$hdr])) {
-				$try_login = $_SERVER[$hdr];
+				$try_login = strtolower($_SERVER[$hdr]);
 				break;
 			}
 		}