uaa should not allow user creation with invalid email address(having special characters except @)

SECURITY NOTICE: If you have found a security problem in the UAA, please do not file a public github issue. Instead, please send an email to security@cloudfoundry.org

Thanks for taking the time to file an issue. You'll minimize back and forth and help us help you more effectively by answering all of the following questions as specifically and completely as you can.

What version of UAA are you running?

UAA Version: 60.2

What output do you see from curl <YOUR_UAA>/info -H'Accept: application/json'
cf login(first time login to CF) with invalid email addess.
Example:
email id: sravan＠example-cf.com

How are you deploying the UAA?

I am deploying the UAA

• using a bosh release I downloaded from bosh.io
• using cf-deployment

What did you do?

1. Login to CF as first time user with invalid special character.
   sravan＠example-cf.com
2. Login was successful, even though the '@' symbol is not appropriate.

What did you expect to see? What goal are you trying to achieve with the UAA?

1. User login with invalid special characters should not be allowed.

hi @uaateam,
We encountered a specific issue with special characters with username and email address on uaadb.
1. We had a CF user, who logged in for first time with email id like below.
  email id: sravan＠example-cf.com
  Login to cf environment is successful & user details in included in uaadb.
2. While trying to assign this particular cf user into any organization, it always fails.
  cf set-org-role sravan@example-cf.com <org name> <org role>
  Error message:
  FAILED
  Server error, status code: 404, error code: 20003, message: The user could not be found
There was difference of characters while doing cf login & cf set-org-role.
cf login was performed with ＠example-cf.com
cf set-org-role was performed with @example-cf.com
$ echo ＠ | xxd
00000000: efbc a00a                                ....
$ echo @ | xxd
00000000: 400a                                     @.
We believe, this character validation should be performed while doing the cf login.
CAPI Version: 1.66.0
UAA Version: 60.2

Slack conversation:
https://cloudfoundry.slack.com/archives/C03FXANBV/p1574128025127300

Reproduce first-time CF login with the full-width ＡＴ-style character shown in the report and compare it with the ASCII @ used by cf set-org-role. Trace where UAA accepts the login and creates the user; done means the invalid address is rejected during login and a regression test covers the behavior.