problem with adAuthenticator - non printable characters added to username

[Scott Cantor]

> On Jul 28, 2026, at 3:11 PM, Peter Schober via users <users at shibboleth.net> wrote:
> 
> Scott Cantor via users <users at shibboleth.net> [2026-07-28 18:38 CEST]:
>> The obvious inference is that the user is entering it and no cleanup
>> is being done to prevent them from getting through to that step.
> 
> Not all that easy getting linefeed, tab and esp NUL byte chars entered
> into a username form field. Password manager run amok?

I don't even pretend to wonder how users do some of the stuff they manage to do anymore. A screen scraper (they call it AI now) is a possibility I guess.

I'm just saying, what else is even possible here? We don't mess with the value unless it's configured to mess with the value. If it's not the client, then the web server is corrupting it I guess.

Notably, this is not attribute resolution. The LDAP authenticator classes are only used during authentication and the log trace there is pretty clear about it being the authenticator.

We probably have some AD-related settings I don't know about in the resolver perhaps, but that class is not part of that step.

-- Scott