Normalize the username entered at login to lowercase

[jvlcek]

LDAP does a case sensitive match of the user name but AD will
do a case insensitive match. By normalizing the userid to
lowercase when using external auth both backed to either
an LDAP directory or AD both will authenticate but only one DB
record, in all lowercase, will be created, even if the user
attempted to login with a mixed case username when backed to AD.

https://bugzilla.redhat.com/show_bug.cgi?id=1448787

Steps for Testing/QA

Test the AD case:

1. Configure an appliance to use authentication Mode: External (httpd) to an AD directory
2. Attempt to login to an appliance with a valid username in mixed case, e.g.: tEsTuSeR1
3. Confirm one user record, with the userid in lowercase, was created.
4. Attempt to login again with a valid username in mixed case but different from step 1. e.g. TestUser1
5. Repeat step 3 with the same username but varying which letters in the username are upper and which are lowercase
6. Confirm the user can log in but only one DB record, with the userid in lowercase, is created.

Test the LDAP case:

1. Configure an appliance to use authentication Mode: External (httpd) to an LDAP directory
2. Attempt to login to an appliance with a valid username, the case must match what is in the LDAP directory because LDAP does a case sensitive lookup
3. Confirm one user record, with the userid in lowercase, was created.
4. Confirm attempts to login to the appliance with the case of the username not matching what is in LDAP fail

[jvlcek]

@abellotti Please review

[jvlcek]

@miq-bot add_label authentication, bug

[miq-bot]

Checked commits jvlcek/manageiq@88a312c~...ce0513c with ruby 2.2.6, rubocop 0.47.1, and haml-lint 0.20.0
2 files checked, 1 offense detected

app/models/authenticator/base.rb

• ❗ - Line 152, Col 16 - Rails/DynamicFindBy - Use find_by instead of dynamic find_by_userid.

[Fryguy]

Is it possible for two users to have the same name but different case? e.g. bob and Bob ?

[jvlcek]

@Fryguy that would be a bug. In fact that is the bug this PR is trying to address. :) But to your point, No, it is not possible for the same user to exist in the directory (Active Directory or LDAP) with the same name but with mismatched case.

So there are 2 perspectives:
1 what is valid in the directory
mismatch case is not
2 what ends up being created in the MiQ DB. An existing bug will create multiple user with mismatched case.

This PR addresses #2 with the understanding that #1 is a tautology :)

Thanks for the help!

[gtanzillo]

👍 Nice!

[simaishi]

@jvlcek @gtanzillo there is a request to backport this to Fine branch. Is that ok?

[jvlcek]

@simaishi I will put together the Fine backport PR.

[simaishi]

@jvlcek thank you. For tracking purpose, I've added fine flags.

[simaishi]

Backported to Fine via #15796