National/unicode characters in login name

[Tobias Galéus]

Hi!

While browsing through our consent records in the mysql database for our Shibboleth IdP I noticed a few records with questionmarks with them, a character that is not used in our user names. After browsing through some more logfiles I've come to the conclusion that you may substitute characters with Unicode characters or national characters and still logon to Shibboleth. For example gugalto, gügältô and gugałtö all works as a username for my password.

Is this a bug or a feature? How can make sure that only my correct username (gugalto) is working?

Best regards,
Tobias Galéus

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180302/51e9ddf4/attachment.html>