Merge remote-tracking branch 'origin/v4.1' into v4.1

1 files changed, 6 insertions, 1 deletions

diff --git a/samples/OpenIdProviderMvc/Controllers/OpenIdController.cs b/samples/OpenIdProviderMvc/Controllers/OpenIdController.cs
index bd6de1b..6abbe17 100644
--- a/samples/OpenIdProviderMvc/Controllers/OpenIdController.cs
+++ b/samples/OpenIdProviderMvc/Controllers/OpenIdController.cs
@@ -267,7 +267,12 @@ namespace OpenIdProviderMvc.Controllers {
 			}
 
 			Uri userLocalIdentifier = Models.User.GetClaimedIdentifierForUser(User.Identity.Name);
-			return authReq.LocalIdentifier == userLocalIdentifier ||
+
+			// Assuming the URLs on the web server are not case sensitive (on Windows servers they almost never are),
+			// and usernames aren't either, compare the identifiers without case sensitivity.
+			// No reason to do this for the PPID identifiers though, since they *can* be case sensitive and are highly
+			// unlikely to be typed in by the user anyway.
+			return string.Equals(authReq.LocalIdentifier.ToString(), userLocalIdentifier.ToString(), StringComparison.OrdinalIgnoreCase) ||
 				authReq.LocalIdentifier == PpidGeneration.PpidIdentifierProvider.GetIdentifier(userLocalIdentifier, authReq.Realm);
 		}
 	}