From 1c0d00206485ed086dd9203da0f968aaaaadb869 Mon Sep 17 00:00:00 2001
From: x032205 <x032205@gmail.com>
Date: Mon, 15 Sep 2025 12:25:13 -0400
Subject: [PATCH] Slugified LDAP username

---
 .../identity-ldap-auth/identity-ldap-auth-service.ts         | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts b/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts
index 447df4c9d..46ec2f98a 100644
--- a/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts
+++ b/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts
@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 import { ForbiddenError } from "@casl/ability";
+import slugify from "@sindresorhus/slugify";
 
 import { IdentityAuthMethod } from "@app/db/schemas";
 import { TIdentityAuthTemplateDALFactory } from "@app/ee/services/identity-auth-template";
@@ -655,7 +656,9 @@ export const identityLdapAuthServiceFactory = ({
     { identityId, username }: TCheckLdapAuthLockoutDTO,
     authFn: () => Promise<T>
   ): Promise<T> => {
-    const LOCKOUT_KEY = `lockout:identity:${identityId}:${IdentityAuthMethod.LDAP_AUTH}:${username.trim().toLowerCase()}`;
+    const usernameSlug = slugify(username.trim().toLowerCase());
+
+    const LOCKOUT_KEY = `lockout:identity:${identityId}:${IdentityAuthMethod.LDAP_AUTH}:${usernameSlug}`;
 
     let lock: Awaited<ReturnType<typeof keyStore.acquireLock>>;
     try {