Missing documentation about correct casing of oiosaml.servlet.keystore.alias

[jkruse]

When configuring the service provider it seems the "oiosaml.servlet.keystore.alias" property value must always be in full lowercase.

In my keystore the alias of the key was shown as "ROV NemLog-in (funktionscertifikat)", but using this value in the configuration resulted in errors suggesting an incorrect keystore password. Changing the property value to full lowercase resolved the problem.

If the alias must be specified in full lowercase, the documentation should state so.

[thomasnymand]

Thanks for the report — this is a genuine bug, not just a documentation gap, and it's now fixed in #85.

Root cause: Java's PKCS12 KeyStore lowercases aliases when the keystore is loaded. In CredentialService the key-password map was keyed by the keystore's (lowercased) alias, while OpenSAML's KeyStoreCredentialResolver looks the password up by the alias you configure, verbatim. So a mixed-case oiosaml.servlet.keystore.alias resolved no key password, the private key couldn't be decrypted, and it surfaced as the misleading "incorrect keystore password" error you saw. Lowercasing the alias worked because it then matched the map key.

Fix: key the password map by the configured alias instead. PKCS12 key lookup is already case-insensitive, so alias resolution is now fully case-insensitive — you can use the alias in whatever casing your keystore tooling shows (e.g. ROV NemLog-in (funktionscertifikat)), no workaround needed. A regression test with a mixed-case alias is included.

See PR #85: #85