Unicode normalization in SASL client breaks non-ASCII passwords

[pmm]

We have users that use U+00A8 (Diaeresis (diacritic) - Wikipedia ) as an Active Directory password. They can not log in using the Elytron LDAP realm. Here's the sequence of events:

• PlainSaslClient.evaluateChallenge calls StringPrep.encode with the profile StringPrep.PROFILE_SASL_STORED https://github.com/wildfly-security/wildfly-elytron/blob/fd74e43caf3e701971b021c3ba8474e83065d049/sasl/plain/src/main/java/org/wildfly/security/sasl/plain/PlainSaslClient.java#L95
• StringPrep.PROFILE_SASL_STORED ors PROFILE_SASL_QUERY which ors NORMALIZE_KC https://github.com/wildfly-security/wildfly-elytron/blob/fd74e43caf3e701971b021c3ba8474e83065d049/sasl/base/src/main/java/org/wildfly/security/sasl/util/StringPrep.java#L67
• StringPrep.encode then normalises using NFKC which replaces U+00A8 with U+0020 U+0308 https://github.com/wildfly-security/wildfly-elytron/blob/fd74e43caf3e701971b021c3ba8474e83065d049/sasl/base/src/main/java/org/wildfly/security/sasl/util/StringPrep.java#L199
• Active Directory rejects the login

We would be wiling to work on a patch but we need some guidance on the desired solution. A simple solution would be a new profile in StringPrep that doesn't do normalization and is used for password.

[mchoma]

Thank you for investigation. Please create a JIRA for Elytron project https://issues.jboss.org/projects/ELY. Best place to discuss the fix is there.

[pmm]

https://issues.jboss.org/browse/ELY-1761