I need to know what is the standard rule for creating username/login ID. Should it be case-sensitive? If I have successfully created three accounts (user2, useR2, USER2), should I consider this a bug?
No, it's not a bug by default. This depends on the requirements of the system, there is not global rule for situations like this. Some operating systems allow the same user with different casing.
Checking for case sensitivity itself isn't a bug in my opinion.
I'd consider it a bug, if the user doesn't get informed about the username being case sensitive. Otherwise one may wonder, why he sometimes can log in fine (Username1) and sometimes gets an error message (username1). In other cases the case-sensitivity is used to add an extra (but very thin) layer to the security.
For usability reasons, if a username is case sensitive it shouldn't be allowed to create accounts with the same name but different capitalization. This part I'd definitely see as a bug.
I'd consider this as a matter of usability/UX. Most services I know use case-insensitive logins, and most people I know use to blame services with case-sensitive logins.
So, I'd say you should check the requirements, and, depending on the result, consult with BA/PO/PM, or whoever you have on the project, and ask him a) if anyone ever thought about login case-sensitivity and b) which option would be correct.
If requirements say it should be case-sensitive, you can also talk to your manager, ask him why he thinks it should be so and share your opinion on the matter.
I agree with @Niels. This cannot be considered as a bug, solely on the basis of being able to create accounts with different set of upper case letters. You should refer to the requirements, to see if it specifically distinguishes between upper case and lower case in case of account creation.
From a UX perspective usernames should NEVER be case sensitive. The marginal gains against brute force attacks do not offset the added UX complexity to the point where a developer cannot QA against the possible mistakes a user can make.
Case in point is the reason that I even searched for and found this discussion thread. I am working with Axis cameras which like many IP cameras is basically an embedded web server. These devices allow for multiple accounts one of which we create for our service folks. Out of typing habit I accidentally created a number of these accounts with an initial cap. I received no warning that usernames are case sensitive.
When the service person could not login I realized that they use the all lowercase version of the username. No problem, I think, just an annoyance. But when I try to delete the "Username" and create the "username" I am met with a user already exists error even though the user is not actually listed. I can add a user with the case sensitive version just fine but to add the lower case version I have to reset the device back to factory defaults to clear out the bad entry in the user table.
For this and many other reasons, Windows usernames are case insensitive and this is why ALL COTS usernames should be case insensitive. If your requirements specify case sensitive users or do not specify user case sensitivity at all, then your requirements are likely wrong and professionally speaking, speak up. If there is a clear justification for a locally developed solution to have case sensitive usernames then be prepared to significant additional testing and user support costs.
Fortunately I only did this on 10 cameras and not all 2000 so I only have a few hours of extra work and service gaps on the 10 cameras that need defaulting but I could just as easily have used the vendor tools to create the capital Username and then I would be having to default our entire plant.
There is NO real upside to case sensitive usernames that I can see and some huge downsides with regard to additional bug testing and user dissatisfaction when the inevitable bugs hit the windshield of life.
Depends on the use case. However, if public usernames allow case, you can have someone impersonate a well-known user by just capitalizing one or more letters.
The username 'president' look like 'presIdent' or 'President' or 'presidenT'.
I would recommend discussing this with the product owner and advocating for case-insensitive usernames, with case-sensitive passwords.
Since passwords are personal and not displayed, case allows for more combinations and permutations.