# Password policy : Password can have part of user name in different cases

**URL:** <https://forum.keycloak.org/t/password-policy-password-can-have-part-of-user-name-in-different-cases/16493>\
**Category:** Getting advice\
**Tags:** admin-console, authentication\
**Created:** [July 18, 2022, 8:04am UTC](https://forum.keycloak.org/t/password-policy-password-can-have-part-of-user-name-in-different-cases/16493 "2022-07-18T08:04:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DHS009](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dhs009/32/6190_2.png) [@DHS009](https://forum.keycloak.org/u/DHS009)\
**Post date:** [July 18, 2022, 8:04am UTC](https://forum.keycloak.org/t/password-policy-password-can-have-part-of-user-name-in-different-cases/16493/1 "2022-07-18T08:04:37Z")

</div>

![password policy](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/2/231cd048ab94ee91c2bc2f5c47bc7a96203631fb.png)

Hi,

I have added the password policy but after that I tried to authenticate the policy. It’s not working well in some conditions.

As per the policy =\> Not username: The password cannot be the same as the username.  
[https://github.com/keycloak/keycloak-documentation/blob/main/server\_admin/topics/authentication/password-policies.adoc](https://github.com/keycloak/keycloak-documentation/blob/main/server_admin/topics/authentication/password-policies.adoc)

Password policy states it shouldn’t contain a part of user name. However, it allows user name in different case.

for example : if the tenant user is → [roger123@yopmail.com](mailto:roger123@yopmail.com)

Then we cannot set password with a part of user name → roger

But if we change the case of it, it allows us to set the password → Roger, ROGER

Is it a bug or I misunderstood the policy?

Please share your views on it.

Thankyou

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [July 20, 2022, 2:51pm UTC](https://forum.keycloak.org/t/password-policy-password-can-have-part-of-user-name-in-different-cases/16493/2 "2022-07-20T14:51:04Z")

</div>

The policy checks for a case-sensitive match:

> <https://github.com/keycloak/keycloak/blob/main/server-spi-private/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProvider.java>

If you want it work differently, you can implement your own provider.