Authorization does not consider the case sensitivity of security providers

If your security provider (eg LDAP) allows case insensitive names then it is possible for a user to be authenticated but not authorized. The userid remembered in the session is the one used to login. When authorizing the case is not checked. So user "foobar" from an external provider logs in as "FOOBAR" and is recognized but denied access, while logging in as "foobar" works as expected.