Repository: goauthentik/authentik

Issue:
[Gitea] Authentication sources with non-lowercase names do not work
When creating an authentication source from Gitea (OAuth), if one supplies a name with uppercase letters in it, the callback URL returned by Authentik will be all lowercase and thus does not match the authentication source in Gitea.
Jenkins login broken due to lower cased redirect URI
**Describe the bug**
Since having upgraded to, I think authentik `2022.5.2`, I can no longer login to jenkins. I made no other changes, so I suspect there is some subtle change in authentik that broke the login. Now I'm running `2022.6.1` but the problem persists.

Symptoms:
The login is processed correctly by authentik and it redirects me back to my jenkins. Jenkins however, displays a generic error message and the logs contain the following:
```
at org.jenkinsci.plugins.oic.OicSecurityRealm$3.onSuccess(OicSecurityRealm.java:394)
at com.google.api.client.auth.openidconnect.IdTokenResponse.execute(IdTokenResponse.java:120)
at com.google.api.client.auth.oauth2.TokenRequest.executeUnparsed(TokenRequest.java:287)
at com.google.api.client.auth.oauth2.TokenResponseException.from(TokenResponseException.java:105)
}
"error_description" : "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method)"
"error" : "invalid_client",
{

com.google.api.client.auth.oauth2.TokenResponseException: 400 Bad Request
```

In the authentik log event stream I can see the following entry along with every login attempt to jenkins:
![grafik](https://user-images.githubusercontent.com/317179/173340462-db1d0458-d45b-46d3-b211-32df5a1aa043.png)

Note the different casing within the expected and actual redirect uri. However, I have no idea where this lower case uri expectation comes from.
When initiating the authenticat from jenkins ,it sends the following request (note the upper case chars in redirect URI):

```
GET https://<redacted>/application/o/authorize/?client_id=<redacted>&redirect_uri=https://<redacted>/securityRealm/finishLogin
```
And the provider configuration looks like this (also upper case chars):
![grafik](https://user-images.githubusercontent.com/317179/173341218-5b597052-a081-49ee-8340-2e90a3e819ac.png)

There is no place known to me, where the lower case version of the expected redirect URI comes into play. So I suspect there is some place within authentik where the actual URI is (errroneously?) lowercased before comparing it to the expected one.

This might relate to #3076

**NOTE:**
While writing this, I tried to configure both: the correct URI and the lower case URI as "Redirect URI" and this seems to work. Putting only one OR the other results in a failed authentication attempt.


Discussion:
Tracked the issue down to here

https://github.com/goauthentik/authentik/blob/6d9579d3e65c7dc86804289be297bf508e8f0b1d/authentik/providers/oauth2/views/token.py#L90

I can't really do much development at the moment, so if someone could get rid of the `lower()` and check if that solves the issue, that would be pretty nice.
Ah shoot, I completely missed that, that should've been removed during the migration regex for allowed redirect URIs....this also explains the Jenkins issue from above..sigh
authentik used to lowercase the URLs before comparing them, before the ability to use regex was introduced. Note that this newer, more strict comparison actually better matches the Specs, as everything after the domain in a URL is case sensitive. The lowercase URL is sent by Jenkins during the token request, as that is part of the spec (https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3). The spec also says that the redirect URI used in the token request must be *identical* to the one used for authorization, so this is technically a Jenkins issue (or rather the plugin), I'm assuming most provider implementations do a lowercase comparison for convenience.
See https://github.com/goauthentik/authentik/issues/3076, this is actually an authentik issue because I missed one `lower()` call when migrating to regex

Resolving patch:
diff --git a/authentik/providers/oauth2/views/token.py b/authentik/providers/oauth2/views/token.py
--- a/authentik/providers/oauth2/views/token.py
+++ b/authentik/providers/oauth2/views/token.py
@@ -87,7 +87,7 @@ def parse(
             provider=provider,
             client_id=client_id,
             client_secret=client_secret,
-            redirect_uri=request.POST.get("redirect_uri", "").lower(),
+            redirect_uri=request.POST.get("redirect_uri", ""),
             grant_type=request.POST.get("grant_type", ""),
             state=request.POST.get("state", ""),
             scope=request.POST.get("scope", "").split(),


Test patch: