After much debugging I've determined that our gerrit instance has some user accounts stored in mixed case. That would be acceptable if it weren't for the fact that we have the configuration option
[[ https://gerrit-review.googlesource.com/Documentation/config-gerrit.html#ldap.localUsernameToLowerCase | ldap.localUsernameToLowerCase ]] specified to force logins to use all lower-case.
The result of this is that gerrit creates duplicate user accounts for anyone who has their account stored in mixed case. Then, seeing the duplicate account record, gerrit refuses to let them log in. This is affecting at least Kaldari I tried to correct one instance of this bug (for user @kaldari) by editing the username via gerrit's rest api, however, gerrit doesn't allow me to edit usernames via api. The only other way I know of to correct the problem is by running the conversion utility provided by gerrit and described [[ https://gerrit-review.googlesource.com/Documentation/pgm-LocalUsernamesToLowerCase.html | here ]]