Force lowercase of username in case-sensitive hashing

I've been able to collect enough samples to determine that 100% of empty ClearPass responses (the case generating our debug emails) have the same thing in common: users are entering their usernames with mixed cases. This is sufficient for the initial authentication and account verification, but it is not okay when it comes to using the EncryptedMapDecorator primarily because when you get into the proxy granting transactions, CAS responds to our application with lowercased usernames and when we go to make a request for that username, ClearPass is unable to locate the key it stored because its hashing mechanism is case-sensitive. This means two different hashes will be generated between squeen08 and Squeen08.

The following is a list of tickets that got back an empty ClearPass response, even though everything else was okay. It was about as far back as I was able to lookup in our CAS logs:

ST-2866 	Squeen
ST-2864 	Squeen
ST-8891 	Wjohnson
ST-8582 	Jpeters002
ST-8579 	Jpeters002
ST-8500 	Jpeters002
ST-8497 	Jpeters002
ST-8486 	Kralph
ST-8483 	Kralph
ST-8473 	Kralph
ST-2596 	CLANGLY
ST-2564 	JRODNEY24
ST-2562 	JRODNEY24
ST-8209 	KSCHAL001
ST-8205 	KSCHAL001
ST-7914 	EZahnee

It appears I am actually able to reproduce this issue myself. Logging as testuser works just fine. Logging in as anything else (e.g. TESTUSER, Testuser, etc) doesn't. An additional behavior I am seeing though is that after logging in using all lowercase testuser, it appears the other mixed cased versions that once failed also are now being accepted.

I also just tried it with LGENE and got back 0 length password. LGene comes back 0 chars. LgEnE comes back 0 chars. But lgene comes back 12 chars and after I've done that, now LGENE comes back with 12 chars. Same for LGene and LgEnE as of right now; they're all working. Seems to be some kind of memory caching of already known usernames in a given time period. 

So the first line of defense against this issue is to update the casLoginView.jsp files to force lowercase of the username field onblur (e.g. jQuery). I'm also going to look into proposing a forced lowercasing of keys in EncryptedMapDecorator and/or TicketRegistryDecorator where a hash of the username is being calculated. I can verify at either of these precise locations in the application, CAS is processing usernames as-is (case-sensitive):

1974: 2013-11-29 15:12:57,051 DEBUG [org.jasig.cas.extension.clearpass.TicketRegistryDecorator] - Creating mapping ticket TGT-4588-CTiyqO0tAOgLeaTv7HlLMDwPxu40SX4zverBjWg1n0JnwOdcfl to user name jpeters002
2224: 2013-11-29 14:54:30,498 DEBUG [org.jasig.cas.extension.clearpass.TicketRegistryDecorator] - Creating mapping ticket TGT-4546-BS1nuW7cLWIHVSi5YEarsAW1T9iRodkDSgZOBsQkNufbQN6mk5 to user name Jpeters002

Take a look at these hashes specifically; notice the hashes for jpeters002 (lowercase) are generated at 2 different timestamps (15:12:00 and 15:12:57) and are identical, whereas the hash calculated for Jpeters002 in between these two is much different. This, I believe, is what is causing our empty passwords:

2013-11-29 15:12:00,456 DEBUG [org.jasig.cas.extension.clearpass.EncryptedMapDecorator] - Generated hash of value [5a9e7ed61b1b11b5d8683f606b84046468221cf6264668f6611dcff22350019d1cd97a325da67f2e7c17ae0bc415e6abbc7191b66b9386ea1cfdeece6c80b272] for key [jpeters002].
2013-11-29 15:12:46,864 DEBUG [org.jasig.cas.extension.clearpass.EncryptedMapDecorator] - Generated hash of value [ad5551247f3ac2de280304a88aab798f89001ee5efeafa83f6d88a46d2649062c79024955f095365e2c041611376f199b1daee384140774c956679d6575d6917] for key [Jpeters002].
2013-11-29 15:12:57,051 DEBUG [org.jasig.cas.extension.clearpass.EncryptedMapDecorator] - Generated hash of value [5a9e7ed61b1b11b5d8683f606b84046468221cf6264668f6611dcff22350019d1cd97a325da67f2e7c17ae0bc415e6abbc7191b66b9386ea1cfdeece6c80b272] for key [jpeters002].

Files updated: TicketRegistryDecorator.java and EncryptedMapDecorator.java

Related JIRA: https://issues.jasig.org/browse/CAS-1386