Forced lowercasing of username and email from ldap-user-import since 26.4.1 breaks case-sensitive applications

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

ldap

Describe the bug

Since upgrading Keycloak from 26.4.0 to 26.4.1 (and later versions, e.g. 26.5.2), usernames and email addresses from ldap users are automatically converted to lowercase during import and authentication.

In previous versions (≤ 26.4.0), Keycloak preserved the original casing. This change breaks integrations with existing applications that rely on case-sensitive usernames or email addresses (e.g. legacy systems or databases where casing is significant).

At the moment, this behavior appears to be enforced and cannot be disabled via configuration. There is no soft migration path.

An option to allow case-sensitive import of usernames and email addresses could solve this problem.

Version

26.5.2

Regression

• The issue is a regression

Expected behavior

• Keycloak should preserve the original casing of usernames and email addresses, as in versions ≤ 26.4.0

or

• There should be a configuration option to disable automatic lowercasing (for backward compatibility).

Actual behavior

• Usernames and email addresses are always stored and processed in lowercase.
• This behavior occurs during:
  • User import
  • Authentication
• Existing applications that expect case-sensitive values fail to authenticate users correctly.

How to Reproduce?

1. Install Keycloak 26.4.1 or later (e.g. 26.5.0)
2. Import a user with a mixed-case username or email
3. Inspect the stored user data in Keycloak
4. Attempt authentication from an application that treats usernames/emails as case-sensitive and expects the user to have at least one capital letter

Anything else?

The following changes/PRs seem to have introduced this change in behaviour:

• https://github.com/keycloak/keycloak/pull/43261
• https://github.com/keycloak/keycloak/pull/43659