SAML: match the email whatever its case (Kelderby's Entra ID sends it capitalised)

Project: Engineering
Type: Bug
Status: Done Done
Priority: High
Organization: Kelderby
Reporter: Lukas Brandt <lukas.brandt@acme-hq.example>
Assignee: Jonas Berg <jonas.berg@acme-hq.example>
Labels: kelderbysingle-sign-on
Components: identity-service
Fix versions: identity-service 2026.10.27
Sprint: Sprint 54
Created: 22 Oct 2026, 13:30 UTC
Updated: 26 Oct 2026, 15:10 UTC
Resolved: 26 Oct 2026, 15:10 UTC

Description

From this morning's rehearsal on KEL-TEST: Kelderby's Entra ID sends the email claim as typed in their directory (Ruth.Jansen@kelderby.example). The NameID is matched ignoring case; the email claim, which we fall back to when the NameID is an object id, is compared exactly. One test account was refused until Henrik changed it to lower case.

Fix

Compare the email claim ignoring case, as the NameID.

Linked issues

relates to OPS-51 Kelderby: switch Rotterdam, Antwerp and Ghent to single sign-on, Saturday 04:30 Done

Comments (1)

Lukas Brandt · 26 Oct 2026, 15:00 UTC

Merged (#465, ACM-354 in Emargen). None of Saturday's nine refusals was a case difference: those were different emails (SUP-1260).