I'm using omniauth-cas together with Gitlab and an external CAS 2.0 server, which works very well besides one issue:
The server happily authenticates usernames with trailing whitespaces (i.e. the server obviously strips ws internally before validating) but then sends the whole username string (including ws) on to the cas module.
This caused us some issues, since gitlab then updates the users table with the new username string (again, inc ws).
This is the first time I've seen this issue, since most of our other CASified systems are behind apache/mod_auth_cas which filters ws before handing on the username.
This fixes it pretty thoroughly, even though it does a bit more than ws-strip uid:
def prune!(hash)
hash.delete_if do |_, value|
+ value.strip! if value.is_a?(String)
prune!(value) if value.is_a?(Hash)
value.nil? || (value.respond_to?(:empty?) && value.empty?)
end
I'm using omniauth-cas together with Gitlab and an external CAS 2.0 server, which works very well besides one issue:
The server happily authenticates usernames with trailing whitespaces (i.e. the server obviously strips ws internally before validating) but then sends the whole username string (including ws) on to the cas module.
This caused us some issues, since gitlab then updates the users table with the new username string (again, inc ws).
This is the first time I've seen this issue, since most of our other CASified systems are behind apache/mod_auth_cas which filters ws before handing on the username.
This fixes it pretty thoroughly, even though it does a bit more than ws-strip uid:
Is this a suitable fix? Should I fix a PR?