anchor.diff:                      {"mail", <<"email">>} ],
   
       Terms = [ {Name, value_of(Key, Data, "unknown") } || {Key, Name} <- LookupFields ],
  -    Result = Terms ++ [ { <<"username">>, UserName },
  +    Result = Terms ++ [ { <<"username">>, CanonicalUserName },
                           { <<"external_authentication_uid">>, UserName },
                           { <<"recovery_authentication_enabled">>, false } ],
  -    {CN, UserName, {Result}}.
  +    {CN, CanonicalUserName, {Result}}.
   
   close({ok, Session}) ->
       eldap:close(Session);
  
positive.code: % In case of unexpected value, don't crash the auth process:
  characters_to_binary(Atom) when is_atom(Atom) ->
      atom_to_binary(Atom, utf8).
  
  
negative.code: maybe_encrypt_session(_, {ok, Session}, _) ->
      {ok, Session}.
  
  -spec canonical_username(string()) -> binary().
  canonical_username(Username) ->
      characters_to_binary(
        re:replace(string:to_lower(Username),
                   "[^a-z0-9_-]",
                   "_",
                   [{return, list}, global])).
  
  result_to_user_ejson(_, UserName, []) ->
      lager:info("User ~p not found in LDAP", [UserName]),
      {error, unauthorized};
  result_to_user_ejson(LoginAttr, UserName, [{eldap_entry, CN, DataIn}|_]) ->
  
      % No guarantees on casing, so let's not make assumptions:
      Data = [ { string:to_lower(Key), Value} || {Key, Value} <- DataIn ],
  
      % loginattr was used to find this record, so we know it must exist;
      % however, multiple LoginAttr fields may exist in the LDAP record, take
      % the first
      [CanonicalUserName|_] = [ canonical_username(U) || U <- proplists:get_value(LoginAttr, Data) ],
  
      % If you are debugging an issue where a new user has authenticated successfully
      % via opscode-manage , but received an odd 400 message when trying to create a
  