This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch 4_0_X
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/4_0_X by this push:
     new 8a3e5b2c46 Ensuring permissions during Realm update
8a3e5b2c46 is described below

commit 8a3e5b2c468cc85ea7bd6a95256b1f3b1f3b2e63
Author: Francesco Chicchiriccò <[email protected]>
AuthorDate: Tue Oct 20 12:47:54 2026 +0200

    Ensuring permissions during Realm update
---
 .../org/apache/syncope/core/logic/RealmLogic.java  |  5 +-
 .../org/apache/syncope/fit/AbstractITCase.java     |  2 +
 .../syncope/fit/core/AuthenticationITCase.java     | 28 +++++------
 .../apache/syncope/fit/core/DelegationITCase.java  |  2 +-
 .../syncope/fit/core/ExceptionMapperITCase.java    |  6 +--
 .../org/apache/syncope/fit/core/JWTITCase.java     |  4 +-
 .../apache/syncope/fit/core/KeymasterITCase.java   |  2 +-
 .../syncope/fit/core/LinkedAccountITCase.java      | 12 ++---
 .../apache/syncope/fit/core/MacroTaskITCase.java   |  2 +-
 .../apache/syncope/fit/core/PullTaskITCase.java    |  4 +-
 .../org/apache/syncope/fit/core/RealmITCase.java   | 36 ++++++++++++++-
 .../org/apache/syncope/fit/core/SCIMITCase.java    |  2 +-
 .../org/apache/syncope/fit/core/UserITCase.java    | 10 ++--
 .../apache/syncope/fit/core/UserIssuesITCase.java  | 20 ++++----
 .../apache/syncope/fit/core/UserRequestITCase.java |  6 +--
 .../apache/syncope/fit/core/UserSelfITCase.java    | 24 +++++-----
 .../syncope/fit/enduser/AbstractEnduserITCase.java |  8 ++--
 .../syncope/fit/enduser/AnonymousITCase.java       |  4 +-
 .../syncope/fit/enduser/AuthenticatedITCase.java   |  4 +-
 pom.xml                                            | 54 +++++++++++-----------
 20 files changed, 139 insertions(+), 96 deletions(-)

diff --git 
a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java 
b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java
index f8c9bc57d6..c82895ce69 100644
--- 
a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java
+++ 
b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java
@@ -143,7 +143,7 @@ public class RealmLogic extends 
AbstractTransactionalLogic<RealmTO> {
                 getOrDefault(IdRepoEntitlement.REALM_SEARCH, Set.of());
         List<RealmTO> result = realmSearchDAO.search(baseRealms, 
effectiveCond, pageable).stream().
                 map(realm -> binder.getRealmTO(
-                realm, 
RealmUtils.SubtreePredicate.of(authorizations).test(realm.getFullPath()))).
+                        realm, 
RealmUtils.SubtreePredicate.of(authorizations).test(realm.getFullPath()))).
                 sorted(Comparator.comparing(RealmTO::getFullPath)).
                 toList();
 
@@ -204,6 +204,9 @@ public class RealmLogic extends 
AbstractTransactionalLogic<RealmTO> {
         PropagationByResource<String> propByRes = binder.update(realm, 
realmTO);
         realm = realmDAO.save(realm);
 
+        // ensure that requester's administration rights are still valid
+        
securityChecks(AuthContextUtils.getAuthorizations().get(IdRepoEntitlement.REALM_UPDATE),
 realm.getFullPath());
+
         List<PropagationTaskInfo> taskInfos = 
propagationManager.setAttributeDeltas(
                 propagationManager.createTasks(realm, propByRes, null),
                 beforeAttrs);
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
index e322d60214..58d9d69c80 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
@@ -232,6 +232,8 @@ public abstract class AbstractITCase {
 
     protected static final String ADMIN_PWD = "password";
 
+    protected static final String DEFAULT_PASSWORD = "password123";
+
     protected static final String ADDRESS = 
"http://localhost:9080/syncope/rest";;
 
     protected static final String BUILD_TOOLS_ADDRESS = 
"http://localhost:9080/syncope-fit-build-tools/cxf";;
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
index 30b4773b75..a6953c126e 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java
@@ -125,7 +125,7 @@ public class AuthenticationITCase extends AbstractITCase {
         assertNotNull(schemaTO);
 
         // 4. read the schema created above (as user) - success
-        SchemaService schemaService2 = 
CLIENT_FACTORY.create(userTO.getUsername(), "password123").
+        SchemaService schemaService2 = 
CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD).
                 getService(SchemaService.class);
         schemaTO = schemaService2.read(SchemaType.PLAIN, schemaName);
         assertNotNull(schemaTO);
@@ -149,7 +149,7 @@ public class AuthenticationITCase extends AbstractITCase {
         UserTO userTO = createUser(userCR).getEntity();
         assertNotNull(userTO);
 
-        UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), 
"password123").
+        UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), 
DEFAULT_PASSWORD).
                 getService(UserService.class);
 
         UserTO readUserTO = 
userService2.read("1417acbe-cbf6-4277-9372-e75e04f97000");
@@ -176,7 +176,7 @@ public class AuthenticationITCase extends AbstractITCase {
 
         // 1. user assigned to role 1, with search entitlement on realms /odd 
and /even: won't find anything with 
         // root realm
-        UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), 
"password123").
+        UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), 
DEFAULT_PASSWORD).
                 getService(UserService.class);
 
         if (IS_EXT_SEARCH_ENABLED) {
@@ -233,7 +233,7 @@ public class AuthenticationITCase extends AbstractITCase {
 
             // 3. instantiate a delegate user service client, for further 
operations
             UserService delegatedUserService =
-                    CLIENT_FACTORY.create(delegatedAdmin.getUsername(), 
"password123").getService(UserService.class);
+                    CLIENT_FACTORY.create(delegatedAdmin.getUsername(), 
DEFAULT_PASSWORD).getService(UserService.class);
 
             // 4. as delegated, create user under realm / -> fail
             UserCR userCR = 
UserITCase.getUniqueSample("[email protected]");
@@ -307,7 +307,7 @@ public class AuthenticationITCase extends AbstractITCase {
         assertNotNull(userTO);
         String userKey = userTO.getKey();
 
-        UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), 
"password123").
+        UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), 
DEFAULT_PASSWORD).
                 getService(UserService.class);
         assertEquals(0, userService2.read(userKey).getFailedLogins());
 
@@ -326,7 +326,7 @@ public class AuthenticationITCase extends AbstractITCase {
         }
         assertEquals(2, USER_SERVICE.read(userKey).getFailedLogins());
 
-        UserService userService4 = CLIENT_FACTORY.create(userTO.getUsername(), 
"password123").
+        UserService userService4 = CLIENT_FACTORY.create(userTO.getUsername(), 
DEFAULT_PASSWORD).
                 getService(UserService.class);
         assertEquals(0, userService4.read(userKey).getFailedLogins());
     }
@@ -380,7 +380,7 @@ public class AuthenticationITCase extends AbstractITCase {
 
         // Access with correct credentials should fail as user is suspended
         try {
-            CLIENT_FACTORY.create(userTO.getUsername(), "password123");
+            CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD);
             fail("This should not happen");
         } catch (NotAuthorizedException e) {
             assertNotNull(e);
@@ -392,7 +392,7 @@ public class AuthenticationITCase extends AbstractITCase {
         assertNotNull(userTO);
         assertEquals("active", userTO.getStatus());
 
-        SyncopeClient goodPwdClient = 
CLIENT_FACTORY.create(userTO.getUsername(), "password123");
+        SyncopeClient goodPwdClient = 
CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD);
         assertEquals(0, 
goodPwdClient.self().user().getFailedLogins().intValue());
     }
 
@@ -579,7 +579,7 @@ public class AuthenticationITCase extends AbstractITCase {
 
         // 2. try to authenticate: fail
         try {
-            CLIENT_FACTORY.create(userTO.getUsername(), "password123").self();
+            CLIENT_FACTORY.create(userTO.getUsername(), 
DEFAULT_PASSWORD).self();
             fail("This should not happen");
         } catch (NotAuthorizedException e) {
             assertNotNull(e);
@@ -596,7 +596,7 @@ public class AuthenticationITCase extends AbstractITCase {
         assertEquals("active", userTO.getStatus());
 
         // 4. try to authenticate again: success
-        SyncopeClient.Self self = CLIENT_FACTORY.create(userTO.getUsername(), 
"password123").self();
+        SyncopeClient.Self self = CLIENT_FACTORY.create(userTO.getUsername(), 
DEFAULT_PASSWORD).self();
         assertNotNull(self);
         assertNotNull(self.entitlements());
         assertEquals(List.of(), self.delegations());
@@ -608,7 +608,7 @@ public class AuthenticationITCase extends AbstractITCase {
         // 1. create user with db resource
         UserCR userCR = 
UserITCase.getUniqueSample("[email protected]");
         userCR.setRealm("/even/two");
-        userCR.setPassword("password123");
+        userCR.setPassword(DEFAULT_PASSWORD);
         userCR.getResources().add(RESOURCE_NAME_TESTDB);
         UserTO user = createUser(userCR).getEntity();
         assertNotNull(user);
@@ -629,10 +629,12 @@ public class AuthenticationITCase extends AbstractITCase {
         JdbcTemplate jdbcTemplate = new JdbcTemplate(testDataSource);
         String value = queryForObject(jdbcTemplate, MAX_WAIT_SECONDS,
                 "SELECT PASSWORD FROM test WHERE ID=?", String.class, 
user.getUsername());
-        assertEquals(encryptorManager.getInstance().encode("password123", 
CipherAlgorithm.SHA1), value.toUpperCase());
+        assertEquals(
+                encryptorManager.getInstance().encode(DEFAULT_PASSWORD, 
CipherAlgorithm.SHA1),
+                value.toUpperCase());
 
         // 5. successfully authenticate with old (on db resource) and new (on 
internal storage) password values
-        SyncopeClient.Self self = CLIENT_FACTORY.create(user.getUsername(), 
"password123").self();
+        SyncopeClient.Self self = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD).self();
         assertNotNull(self);
         self = CLIENT_FACTORY.create(user.getUsername(), "password234").self();
         assertNotNull(self);
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DelegationITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DelegationITCase.java
index 7961ca204b..071634ebe9 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DelegationITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DelegationITCase.java
@@ -155,7 +155,7 @@ public class DelegationITCase extends AbstractITCase {
         delegation.setDelegated(delegated.getKey());
         delegation.setStart(OffsetDateTime.now());
 
-        DelegationService uds = 
CLIENT_FACTORY.create(delegating.getUsername(), "password123").
+        DelegationService uds = 
CLIENT_FACTORY.create(delegating.getUsername(), DEFAULT_PASSWORD).
                 getService(DelegationService.class);
 
         // delegating user is not requesting user -> FAIL
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java
index 461a83da0b..a46fdf4f7b 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java
@@ -79,7 +79,7 @@ public class ExceptionMapperITCase extends AbstractITCase {
         userTO1.getAuxClasses().add(typeClass.getKey());
         String userId1 = getUUIDString() + "[email protected]";
         userTO1.setUsername(userId1);
-        userTO1.setPassword("password123");
+        userTO1.setPassword(DEFAULT_PASSWORD);
 
         userTO1.getPlainAttrs().add(attr("userId", userId1));
         userTO1.getPlainAttrs().add(attr("fullname", userId1));
@@ -94,7 +94,7 @@ public class ExceptionMapperITCase extends AbstractITCase {
         userTO2.getAuxClasses().add(typeClass.getKey());
         String userId2 = getUUIDString() + "[email protected]";
         userTO2.setUsername(userId2);
-        userTO2.setPassword("password123");
+        userTO2.setPassword(DEFAULT_PASSWORD);
 
         userTO2.getPlainAttrs().add(attr("userId", userId2));
         userTO2.getPlainAttrs().add(attr("fullname", userId2));
@@ -140,7 +140,7 @@ public class ExceptionMapperITCase extends AbstractITCase {
         userCR.setRealm(SyncopeConstants.ROOT_REALM);
         String userId = getUUIDString() + "[email protected]";
         userCR.setUsername(userId);
-        userCR.setPassword("password123");
+        userCR.setPassword(DEFAULT_PASSWORD);
 
         userCR.getPlainAttrs().add(attr("userId", "issue654"));
         userCR.getPlainAttrs().add(attr("fullname", userId));
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/JWTITCase.java 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/JWTITCase.java
index 0d68b318d6..14087b5dd8 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/JWTITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/JWTITCase.java
@@ -494,7 +494,7 @@ public class JWTITCase extends AbstractITCase {
 
             // login, get JWT with expiration
             SyncopeClient.JwtInfo jwtInfo =
-                    CLIENT_FACTORY.create(user.getUsername(), 
"password123").jwtInfo().orElseThrow();
+                    CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD).jwtInfo().orElseThrow();
 
             Date expiration = 
SignedJWT.parse(jwtInfo.value()).getJWTClaimsSet().getExpirationTime();
             assertNotNull(expiration);
@@ -512,7 +512,7 @@ public class JWTITCase extends AbstractITCase {
 
             // login again, get new JWT
             // (even if ExpiredAccessTokenCleanup did not run yet, as it is 
scheduled every 5 minutes)
-            String newJWT = CLIENT_FACTORY.create(user.getUsername(), 
"password123").jwtInfo().orElseThrow().value();
+            String newJWT = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD).jwtInfo().orElseThrow().value();
             assertNotEquals(jwtInfo.value(), newJWT);
         } finally {
             confParamOps.set(SyncopeConstants.MASTER_DOMAIN, 
"jwt.lifetime.minutes", orig);
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/KeymasterITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/KeymasterITCase.java
index cf30a5de4e..759cecc953 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/KeymasterITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/KeymasterITCase.java
@@ -267,7 +267,7 @@ public class KeymasterITCase extends AbstractITCase {
 
         Response response = USER_SERVICE.create(
                 new UserCR.Builder(SyncopeConstants.ROOT_REALM, "monteverdi").
-                        password("password123").
+                        password(DEFAULT_PASSWORD).
                         plainAttr(attr("email", 
"[email protected]")).
                         build());
         assertEquals(Response.Status.CREATED.getStatusCode(), 
response.getStatus());
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/LinkedAccountITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/LinkedAccountITCase.java
index 02e1f2a74e..8415d9fc56 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/LinkedAccountITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/LinkedAccountITCase.java
@@ -183,7 +183,7 @@ public class LinkedAccountITCase extends AbstractITCase {
 
         LinkedAccountTO account = new 
LinkedAccountTO.Builder(RESOURCE_NAME_LDAP, connObjectKeyValue).build();
         account.getPlainAttrs().add(attr("surname", "LINKED_SURNAME"));
-        account.setPassword("Password123");
+        account.setPassword(DEFAULT_PASSWORD);
         userUR.getLinkedAccounts().add(new 
LinkedAccountUR.Builder().linkedAccountTO(account).build());
 
         user = updateUser(userUR).getEntity();
@@ -233,7 +233,7 @@ public class LinkedAccountITCase extends AbstractITCase {
         assertNull(user.getLinkedAccounts().getFirst().getPassword());
 
         // 4. update linked account with adding a password
-        account.setPassword("Password123");
+        account.setPassword(DEFAULT_PASSWORD);
         userUR = new UserUR();
         userUR.setKey(user.getKey());
         userUR.getLinkedAccounts().add(new 
LinkedAccountUR.Builder().linkedAccountTO(account).build());
@@ -255,7 +255,7 @@ public class LinkedAccountITCase extends AbstractITCase {
                 forEach(task -> TASK_SERVICE.delete(TaskType.PROPAGATION, 
task.getKey()));
 
         // set a correct password
-        account.setPassword("Password123");
+        account.setPassword(DEFAULT_PASSWORD);
         user = updateUser(userUR).getEntity();
         assertNotNull(user.getLinkedAccounts().getFirst().getPassword());
 
@@ -479,7 +479,7 @@ public class LinkedAccountITCase extends AbstractITCase {
 
         ObjectNode user = JSON_MAPPER.createObjectNode();
         user.put("username", "linkedaccount1");
-        user.put("password", "Password123");
+        user.put("password", DEFAULT_PASSWORD);
         user.put("firstName", "Pasquale");
         user.put("surname", "Vivaldi");
         user.put("email", "[email protected]");
@@ -491,7 +491,7 @@ public class LinkedAccountITCase extends AbstractITCase {
 
         user = JSON_MAPPER.createObjectNode();
         user.put("username", "vivaldi");
-        user.put("password", "Password123");
+        user.put("password", DEFAULT_PASSWORD);
         user.put("firstName", "Giovannino");
         user.put("surname", "Vivaldi");
         user.put("email", "[email protected]");
@@ -503,7 +503,7 @@ public class LinkedAccountITCase extends AbstractITCase {
 
         user = JSON_MAPPER.createObjectNode();
         user.put("username", "not.vivaldi");
-        user.put("password", "Password123");
+        user.put("password", DEFAULT_PASSWORD);
         user.put("email", "[email protected]");
 
         response = webClient.post(user.toString());
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java
index 01dee1f8c2..8ebd9cba25 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java
@@ -265,7 +265,7 @@ public class MacroTaskITCase extends AbstractITCase {
 
         // 3. attempt to run the macro task -> fail
         TaskService taskService = CLIENT_FACTORY.create(
-                userTO.getUsername(), 
"password123").getService(TaskService.class);
+                userTO.getUsername(), 
DEFAULT_PASSWORD).getService(TaskService.class);
         try {
             taskService.execute(new 
ExecSpecs.Builder().key(MACRO_TASK_KEY).build());
             fail();
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
index e3e2b9641c..dea32e3e87 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java
@@ -264,7 +264,7 @@ public class PullTaskITCase extends AbstractTaskITCase {
         // -----------------------------
         UserCR inUserRC = new UserCR();
         inUserRC.setRealm(SyncopeConstants.ROOT_REALM);
-        inUserRC.setPassword("password123");
+        inUserRC.setPassword(DEFAULT_PASSWORD);
         String userName = "test9";
         inUserRC.setUsername(userName);
         inUserRC.getPlainAttrs().add(attr("firstname", "nome9"));
@@ -1029,7 +1029,7 @@ public class PullTaskITCase extends AbstractTaskITCase {
         //-----------------------------
         UserCR userCR = new UserCR();
         userCR.setRealm(SyncopeConstants.ROOT_REALM);
-        userCR.setPassword("password123");
+        userCR.setPassword(DEFAULT_PASSWORD);
         userCR.setUsername("testuser2");
 
         userCR.getPlainAttrs().add(attr("firstname", "testuser2"));
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RealmITCase.java 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RealmITCase.java
index 20329dcdb7..7e99dc8a55 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RealmITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RealmITCase.java
@@ -577,6 +577,40 @@ public class RealmITCase extends AbstractITCase {
         assertNull(getLdapRemoteObject("ou=test,o=isp"));
     }
 
+    @Test
+    public void permissions() {
+        RoleTO realmUpdate = new RoleTO();
+        realmUpdate.setKey(getUUIDString());
+        realmUpdate.getEntitlements().add(IdRepoEntitlement.REALM_UPDATE);
+        realmUpdate.getRealms().add("/even");
+        realmUpdate = createRole(realmUpdate);
+
+        UserCR req = 
UserITCase.getUniqueSample("[email protected]");
+        req.getRoles().add(realmUpdate.getKey());
+        UserTO user = createUser(req).getEntity();
+
+        // user can update only realms with base /even
+        RealmService service = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD).
+                getService(RealmService.class);
+
+        // 1. two can be safely updated because is descendant of even
+        RealmTO two = getRealm("/even/two").orElseThrow();
+        assertDoesNotThrow(() -> service.update(two));
+
+        // 2. odd cannot be updated because not descendant of even
+        RealmTO odd = getRealm("/odd").orElseThrow();
+        SyncopeClientException e = assertThrows(SyncopeClientException.class, 
() -> service.update(odd));
+        assertEquals(ClientExceptionType.DelegatedAdministration, e.getType());
+
+        // 3. attempting to change two's parent, to move it under odd, is 
forbidden
+        two.setParent(odd.getKey());
+        e = assertThrows(SyncopeClientException.class, () -> 
service.update(two));
+        assertEquals(ClientExceptionType.DelegatedAdministration, e.getType());
+
+        // 4. check that two was not changed
+        assertEquals(getRealm("/even").orElseThrow().getKey(), 
getRealm("/even/two").orElseThrow().getParent());
+    }
+
     @Test
     public void issueSYNCOPE1472() {
         // 1. assign twice resource-ldap-orgunit to /odd
@@ -613,7 +647,7 @@ public class RealmITCase extends AbstractITCase {
         userCR.getRoles().add(role.getKey());
         UserTO manager = createUser(userCR).getEntity();
         RealmService managerRealmService = CLIENT_FACTORY.create(
-                manager.getUsername(), 
"password123").getService(RealmService.class);
+                manager.getUsername(), 
DEFAULT_PASSWORD).getService(RealmService.class);
 
         RealmTO childRealm = null;
         try {
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java
index 27d989bf35..803f8c21eb 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java
@@ -140,7 +140,7 @@ public class SCIMITCase extends AbstractITCase {
 
     private static SCIMUser getSampleUser(final String username, final 
List<String> schemas) {
         SCIMUser user = new SCIMUser(null, schemas, null, username, true);
-        user.setPassword("password123");
+        user.setPassword(DEFAULT_PASSWORD);
 
         SCIMUserName name = new SCIMUserName();
         name.setGivenName(username);
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
index 17d52b7eb9..3f242f2182 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java
@@ -111,7 +111,7 @@ public class UserITCase extends AbstractITCase {
 
     public static UserCR getSample(final String email) {
         return new UserCR.Builder(SyncopeConstants.ROOT_REALM, email).
-                password("password123").
+                password(DEFAULT_PASSWORD).
                 plainAttr(attr("fullname", email)).
                 plainAttr(attr("firstname", email)).
                 plainAttr(attr("surname", "surname")).
@@ -138,7 +138,7 @@ public class UserITCase extends AbstractITCase {
     public void createUserWithNoPropagation() {
         // create a new user
         UserCR req = getUniqueSample("[email protected]");
-        req.setPassword("password123");
+        req.setPassword(DEFAULT_PASSWORD);
         req.getResources().add(RESOURCE_NAME_NOPROPAGATION);
 
         UserTO userTO = createUser(req).getEntity();
@@ -344,7 +344,7 @@ public class UserITCase extends AbstractITCase {
 
         // 3. verify password
         try {
-            SyncopeClient.Self self = 
CLIENT_FACTORY.create(userTO.getUsername(), "password123").self();
+            SyncopeClient.Self self = 
CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD).self();
             assertNotNull(self);
         } catch (NotAuthorizedException e) {
             fail("Credentials should be valid and not cause 
NotAuthorizedException");
@@ -548,7 +548,7 @@ public class UserITCase extends AbstractITCase {
 
             UserUR userUR = new UserUR();
             userUR.setKey(userTO.getKey());
-            userUR.setPassword(new 
PasswordPatch.Builder().value("password123").build());
+            userUR.setPassword(new 
PasswordPatch.Builder().value(DEFAULT_PASSWORD).build());
 
             USER_SERVICE.update(userUR);
         });
@@ -1201,7 +1201,7 @@ public class UserITCase extends AbstractITCase {
         }
 
         ResourceAR resourceAR = new ResourceAR.Builder().key(actual.getKey()).
-                
value("password123").action(ResourceAssociationAction.ASSIGN).resource(RESOURCE_NAME_CSV).build();
+                
value(DEFAULT_PASSWORD).action(ResourceAssociationAction.ASSIGN).resource(RESOURCE_NAME_CSV).build();
 
         assertNotNull(parseBatchResponse(USER_SERVICE.associate(resourceAR)));
 
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
index dd3b3827b0..0ebc511237 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java
@@ -147,7 +147,7 @@ public class UserIssuesITCase extends AbstractITCase {
         userCR.setRealm(SyncopeConstants.ROOT_REALM);
         String userId = getUUIDString() + "[email protected]";
         userCR.setUsername(userId);
-        userCR.setPassword("password123");
+        userCR.setPassword(DEFAULT_PASSWORD);
 
         userCR.getPlainAttrs().add(attr("userId", userId));
         userCR.getPlainAttrs().add(attr("fullname", userId));
@@ -761,7 +761,7 @@ public class UserIssuesITCase extends AbstractITCase {
         userCR.setRealm(SyncopeConstants.ROOT_REALM);
         String userId = getUUIDString() + "[email protected]";
         userCR.setUsername(userId);
-        userCR.setPassword("password123");
+        userCR.setPassword(DEFAULT_PASSWORD);
 
         userCR.getPlainAttrs().add(attr("userId", userId));
         userCR.getPlainAttrs().add(attr("fullname", userId));
@@ -884,7 +884,7 @@ public class UserIssuesITCase extends AbstractITCase {
         // 3. try (and succeed) to perform simple LDAP binding with provided 
password ('password123')
         assertNotNull(getLdapRemoteObject(
                 
connObject.getAttr(Name.NAME).orElseThrow().getValues().getFirst(),
-                "password123",
+                DEFAULT_PASSWORD,
                 
connObject.getAttr(Name.NAME).orElseThrow().getValues().getFirst()));
 
         // 4. update user without any password change request
@@ -898,7 +898,7 @@ public class UserIssuesITCase extends AbstractITCase {
         // 5. try (and succeed again) to perform simple LDAP binding: password 
has not changed
         assertNotNull(getLdapRemoteObject(
                 
connObject.getAttr(Name.NAME).orElseThrow().getValues().getFirst(),
-                "password123",
+                DEFAULT_PASSWORD,
                 
connObject.getAttr(Name.NAME).orElseThrow().getValues().getFirst()));
     }
 
@@ -1245,7 +1245,7 @@ public class UserIssuesITCase extends AbstractITCase {
                 
assertTrue(e.getElements().iterator().next().startsWith("InvalidPassword"));
             }
 
-            userCR.setPassword("password123");
+            userCR.setPassword(DEFAULT_PASSWORD);
             UserTO user = createUser(userCR).getEntity();
             assertNotNull(user);
         } finally {
@@ -1480,7 +1480,7 @@ public class UserIssuesITCase extends AbstractITCase {
         try {
             // 2. create user under /even/two to get password policy with 
history length 1
             UserCR userCR = 
UserITCase.getUniqueSample("[email protected]");
-            userCR.setPassword("Password123");
+            userCR.setPassword(DEFAULT_PASSWORD);
             userCR.setRealm("/even/two");
             UserTO userTO = createUser(userCR).getEntity();
             assertNotNull(userTO);
@@ -1488,7 +1488,7 @@ public class UserIssuesITCase extends AbstractITCase {
             // 3. attempt to set the same password value: fails
             UserUR req = new UserUR();
             req.setKey(userTO.getKey());
-            req.setPassword(new 
PasswordPatch.Builder().onSyncope(true).value("Password123").build());
+            req.setPassword(new 
PasswordPatch.Builder().onSyncope(true).value(DEFAULT_PASSWORD).build());
             try {
                 updateUser(req);
                 fail("Password update should not work");
@@ -1503,7 +1503,7 @@ public class UserIssuesITCase extends AbstractITCase {
             assertNotNull(userTO);
 
             // 5. set the original password value: works (history length is 1)
-            req.setPassword(new 
PasswordPatch.Builder().onSyncope(true).value("Password123").build());
+            req.setPassword(new 
PasswordPatch.Builder().onSyncope(true).value(DEFAULT_PASSWORD).build());
             userTO = updateUser(req).getEntity();
             assertNotNull(userTO);
         } finally {
@@ -1520,7 +1520,7 @@ public class UserIssuesITCase extends AbstractITCase {
         userUR.setPassword(new PasswordPatch.Builder()
                 .onSyncope(false)
                 .resource(RESOURCE_NAME_TESTDB)
-                .value("Password123")
+                .value(DEFAULT_PASSWORD)
                 .build());
         userUR.getResources().add(new StringPatchItem.Builder()
                 .value(RESOURCE_NAME_TESTDB)
@@ -1618,7 +1618,7 @@ public class UserIssuesITCase extends AbstractITCase {
         userCR.getRoles().add(role.getKey());
         UserTO userTO = createUser(userCR).getEntity();
 
-        UserService userService = CLIENT_FACTORY.create(userTO.getUsername(), 
"password123").
+        UserService userService = CLIENT_FACTORY.create(userTO.getUsername(), 
DEFAULT_PASSWORD).
                 getService(UserService.class);
         Response response = userService.associate(new 
ResourceAR.Builder().key(userTO.getKey()).
                 
resource(RESOURCE_NAME_NOPROPAGATION).action(ResourceAssociationAction.ASSIGN).build());
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java
index ecf977f6e2..c2c1fda310 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java
@@ -100,7 +100,7 @@ public class UserRequestITCase extends AbstractITCase {
         assertEquals(req.getUsername(), user.getUsername());
 
         // check that user can see the ongoing request
-        SyncopeClient client = CLIENT_FACTORY.create(user.getUsername(), 
"password123");
+        SyncopeClient client = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD);
         PagedResult<UserRequest> requests = 
client.getService(UserRequestService.class).
                 listRequests(new 
UserRequestQuery.Builder().user(user.getKey()).build());
         assertEquals(1, requests.getTotalCount());
@@ -209,7 +209,7 @@ public class UserRequestITCase extends AbstractITCase {
         List<RelationshipTO> relationships = 
USER_SERVICE.read(user.getKey()).getRelationships();
         assertTrue(relationships.isEmpty());
 
-        SyncopeClient client = CLIENT_FACTORY.create(user.getUsername(), 
"password123");
+        SyncopeClient client = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD);
 
         // start request as user
         UserRequestService service = 
client.getService(UserRequestService.class);
@@ -284,7 +284,7 @@ public class UserRequestITCase extends AbstractITCase {
         UserTO user = 
createUser(UserITCase.getUniqueSample("[email protected]")).getEntity();
         assertNotNull(user);
 
-        SyncopeClient client = CLIENT_FACTORY.create(user.getUsername(), 
"password123");
+        SyncopeClient client = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD);
 
         WorkflowTaskExecInput testInput = new WorkflowTaskExecInput();
         testInput.getVariables().put("providedVariable", "test");
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
index 0938a817b6..36fed632aa 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java
@@ -206,7 +206,7 @@ public class UserSelfITCase extends AbstractITCase {
     @Test
     public void read() {
         UserTO user = 
createUser(UserITCase.getUniqueSample("[email protected]")).getEntity();
-        UserService us2 = CLIENT_FACTORY.create(user.getUsername(), 
"password123").getService(UserService.class);
+        UserService us2 = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD).getService(UserService.class);
         try {
             us2.read(user.getKey());
             fail("This should not happen");
@@ -214,7 +214,7 @@ public class UserSelfITCase extends AbstractITCase {
             assertNotNull(e);
         }
 
-        SyncopeClient.Self self = CLIENT_FACTORY.create(user.getUsername(), 
"password123").self();
+        SyncopeClient.Self self = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD).self();
         assertEquals(user.getUsername(), self.user().getUsername());
     }
 
@@ -241,7 +241,7 @@ public class UserSelfITCase extends AbstractITCase {
         userUR.setKey(created.getKey());
         userUR.setUsername(new 
StringReplacePatchItem.Builder().value(created.getUsername() + "XX").build());
 
-        SyncopeClient authClient = 
CLIENT_FACTORY.create(created.getUsername(), "password123");
+        SyncopeClient authClient = 
CLIENT_FACTORY.create(created.getUsername(), DEFAULT_PASSWORD);
         UserTO updated = 
authClient.getService(UserSelfService.class).update(userUR).
                 readEntity(new GenericType<ProvisioningResult<UserTO>>() {
                 }).getEntity();
@@ -272,7 +272,7 @@ public class UserSelfITCase extends AbstractITCase {
         userUR.setPassword(new PasswordPatch.Builder().
                 
value("newPassword123").onSyncope(false).resource(RESOURCE_NAME_TESTDB).build());
 
-        SyncopeClient authClient = 
CLIENT_FACTORY.create(created.getUsername(), "password123");
+        SyncopeClient authClient = 
CLIENT_FACTORY.create(created.getUsername(), DEFAULT_PASSWORD);
         UserTO updated = 
authClient.getService(UserSelfService.class).update(userUR).
                 readEntity(new GenericType<ProvisioningResult<UserTO>>() {
                 }).getEntity();
@@ -312,7 +312,7 @@ public class UserSelfITCase extends AbstractITCase {
         UserTO created = 
createUser(UserITCase.getUniqueSample("[email protected]")).getEntity();
         assertNotNull(created);
 
-        SyncopeClient authClient = 
CLIENT_FACTORY.create(created.getUsername(), "password123");
+        SyncopeClient authClient = 
CLIENT_FACTORY.create(created.getUsername(), DEFAULT_PASSWORD);
         UserTO deleted = 
authClient.getService(UserSelfService.class).delete().readEntity(
                 new GenericType<ProvisioningResult<UserTO>>() {
         }).getEntity();
@@ -340,7 +340,7 @@ public class UserSelfITCase extends AbstractITCase {
         assertTrue(StringUtils.isNotBlank(pwdOnResource));
 
         // 2. verify that new user is able to authenticate
-        SyncopeClient authClient = CLIENT_FACTORY.create(user.getUsername(), 
"password123");
+        SyncopeClient authClient = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD);
         UserTO read = authClient.self().user();
         assertNotNull(read);
 
@@ -406,7 +406,7 @@ public class UserSelfITCase extends AbstractITCase {
         createUser(user);
 
         // 2. verify that new user is able to authenticate
-        SyncopeClient authClient = CLIENT_FACTORY.create(user.getUsername(), 
"password123");
+        SyncopeClient authClient = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD);
         UserTO read = authClient.self().user();
         assertNotNull(read);
 
@@ -470,10 +470,10 @@ public class UserSelfITCase extends AbstractITCase {
 
         // 3. change password
         vivaldiClient.getService(UserSelfService.class).
-                mustChangePassword(new 
PasswordPatch.Builder().value("password123").build());
+                mustChangePassword(new 
PasswordPatch.Builder().value(DEFAULT_PASSWORD).build());
 
         // 4. verify it worked
-        SyncopeClient.Self self = CLIENT_FACTORY.create("vivaldi", 
"password123").self();
+        SyncopeClient.Self self = CLIENT_FACTORY.create("vivaldi", 
DEFAULT_PASSWORD).self();
         assertFalse(self.user().isMustChangePassword());
     }
 
@@ -658,7 +658,7 @@ public class UserSelfITCase extends AbstractITCase {
         req.setKey(created.getKey());
         req.getMemberships().add(new 
MembershipUR.Builder("b1f7c12d-ec83-441f-a50e-1691daaedf3b").build());
 
-        SyncopeClient client = CLIENT_FACTORY.create(created.getUsername(), 
"password123");
+        SyncopeClient client = CLIENT_FACTORY.create(created.getUsername(), 
DEFAULT_PASSWORD);
         Response response = 
client.getService(UserSelfService.class).update(req);
         assertEquals(Response.Status.OK.getStatusCode(), response.getStatus());
         assertEquals("updateApproval", 
USER_SERVICE.read(created.getKey()).getStatus());
@@ -805,7 +805,7 @@ public class UserSelfITCase extends AbstractITCase {
                 role(new StringPatchItem.Builder().value("User 
manager").build()).
                 build();
 
-        SyncopeClient authClient = CLIENT_FACTORY.create(user.getUsername(), 
"password123");
+        SyncopeClient authClient = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD);
         e = assertThrows(
                 SyncopeClientException.class,
                 () -> 
authClient.getService(UserSelfService.class).update(userUR));
@@ -852,7 +852,7 @@ public class UserSelfITCase extends AbstractITCase {
                 role(new StringPatchItem.Builder().value("User 
manager").build()).
                 build();
 
-        SyncopeClient authClient = CLIENT_FACTORY.create(user.getUsername(), 
"password123");
+        SyncopeClient authClient = CLIENT_FACTORY.create(user.getUsername(), 
DEFAULT_PASSWORD);
         user = authClient.getService(UserSelfService.class).
                 update(userUR).
                 readEntity(new GenericType<ProvisioningResult<UserTO>>() {
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AbstractEnduserITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AbstractEnduserITCase.java
index 39b81b7e0f..c8d5f6609a 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AbstractEnduserITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AbstractEnduserITCase.java
@@ -63,6 +63,8 @@ import 
org.springframework.test.context.support.TestPropertySourceUtils;
 
 public abstract class AbstractEnduserITCase extends AbstractUIITCase {
 
+    protected static final String DEFAULT_PASSWORD = "password123";
+
     @ImportAutoConfiguration(classes = {
         SelfKeymasterClientContext.class,
         ZookeeperKeymasterClientContext.class,
@@ -175,7 +177,7 @@ public abstract class AbstractEnduserITCase extends 
AbstractUIITCase {
 
         // create test user for must change password
         USER_SERVICE.create(new UserCR.Builder(SyncopeConstants.ROOT_REALM, 
"mustchangepassword").
-                password("password123").
+                password(DEFAULT_PASSWORD).
                 mustChangePassword(true).
                 plainAttr(attr("fullname", "[email protected]")).
                 plainAttr(attr("firstname", "[email protected]")).
@@ -188,7 +190,7 @@ public abstract class AbstractEnduserITCase extends 
AbstractUIITCase {
 
         // create test user for self password reset
         USER_SERVICE.create(new UserCR.Builder(SyncopeConstants.ROOT_REALM, 
"selfpwdreset").
-                password("password123").
+                password(DEFAULT_PASSWORD).
                 plainAttr(attr("fullname", "[email protected]")).
                 plainAttr(attr("firstname", "[email protected]")).
                 plainAttr(attr("surname", "surname")).
@@ -200,7 +202,7 @@ public abstract class AbstractEnduserITCase extends 
AbstractUIITCase {
 
         // create test user for self update
         USER_SERVICE.create(new UserCR.Builder(SyncopeConstants.ROOT_REALM, 
"selfupdate").
-                password("password123").
+                password(DEFAULT_PASSWORD).
                 plainAttr(attr("fullname", "[email protected]")).
                 plainAttr(attr("firstname", "[email protected]")).
                 plainAttr(attr("surname", "surname")).
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AnonymousITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AnonymousITCase.java
index b190552831..8450d99089 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AnonymousITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AnonymousITCase.java
@@ -55,11 +55,11 @@ public class AnonymousITCase extends AbstractEnduserITCase {
 
         formTester.setValue(
                 
"userDetailsPanelCard:contentPanel:password:passwordPanel:passwordInnerForm:password:passwordField",
-                "Password123");
+                DEFAULT_PASSWORD);
         formTester.setValue(
                 
"userDetailsPanelCard:contentPanel:password:passwordPanel:passwordInnerForm:confirmPassword:"
                 + "passwordField",
-                "Password123");
+                DEFAULT_PASSWORD);
 
         formTester.setValue(
                 
"plainAttrsPanelCard:contentPanel:plainSchemas:schemas:7:panel:textField",
diff --git 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AuthenticatedITCase.java
 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AuthenticatedITCase.java
index ab2ba67a35..d9d9b2ae3e 100644
--- 
a/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AuthenticatedITCase.java
+++ 
b/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AuthenticatedITCase.java
@@ -56,7 +56,7 @@ public class AuthenticatedITCase extends 
AbstractEnduserITCase {
                 mustChangePassword(new 
BooleanReplacePatchItem.Builder().value(Boolean.TRUE).build()).build());
 
         TESTER.startPage(Login.class);
-        doLogin("mustchangepassword", "password123");
+        doLogin("mustchangepassword", DEFAULT_PASSWORD);
 
         TESTER.assertRenderedPage(MustChangePassword.class);
 
@@ -90,7 +90,7 @@ public class AuthenticatedITCase extends 
AbstractEnduserITCase {
         String newEmail = "[email protected]";
 
         TESTER.startPage(Login.class);
-        doLogin(username, "password123");
+        doLogin(username, DEFAULT_PASSWORD);
 
         
TESTER.assertComponent("body:contentWrapper:content:userProfileInfo:userProfile",
 WebMarkupContainer.class);
 
diff --git a/pom.xml b/pom.xml
index 6f08bf5a35..52284a8d7c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -2030,33 +2030,33 @@ under the License.
         <groupId>org.apache.rat</groupId>
         <artifactId>apache-rat-plugin</artifactId>
         <configuration>
-          <excludes>
-            <exclude>**/nbactions.xml</exclude>
-            <exclude>**/nb-configuration.xml</exclude>
-            <exclude>**/META-INF/cxf/**</exclude>
-            <exclude>**/META-INF/services/**</exclude>
-            <exclude>**/META-INF/MANIFEST.MF</exclude>
-            <exclude>**/*.csv</exclude>
-            <exclude>**/archetype-resources/**</exclude>
-            <exclude>**/adminlte*</exclude>
-            <exclude>**/dataTables.bootstrap5.min.css</exclude>
-            <exclude>**/goal.txt</exclude>
-            <exclude>**/rat.txt</exclude>
-            <exclude>**/build-copy-javadoc-files.xml</exclude>
-            <exclude>**/maven-eclipse.xml</exclude>
-            <exclude>**/*.iml</exclude>
-            <exclude>**/*.log</exclude>
-            <exclude>**/.externalToolBuilders/**</exclude>
-            <exclude>.git/**</exclude>
-            <exclude>.idea/**</exclude>
-            <exclude>**/.settings/**</exclude>
-            <exclude>**/.*</exclude>
-            <exclude>**/*.lst</exclude>
-            <exclude>**/*.json</exclude>
-            <exclude>**/*font*awesome*</exclude>
-            <exclude>**/banner.txt</exclude>
-            <exclude>**/target/**</exclude>
-          </excludes>
+          <inputExcludes>
+            <inputExclude>**/nbactions.xml</inputExclude>
+            <inputExclude>**/nb-configuration.xml</inputExclude>
+            <inputExclude>**/META-INF/cxf/**</inputExclude>
+            <inputExclude>**/META-INF/services/**</inputExclude>
+            <inputExclude>**/META-INF/MANIFEST.MF</inputExclude>
+            <inputExclude>**/*.csv</inputExclude>
+            <inputExclude>**/archetype-resources/**</inputExclude>
+            <inputExclude>**/adminlte*</inputExclude>
+            <inputExclude>**/dataTables.bootstrap5.min.css</inputExclude>
+            <inputExclude>**/goal.txt</inputExclude>
+            <inputExclude>**/rat.txt</inputExclude>
+            <inputExclude>**/build-copy-javadoc-files.xml</inputExclude>
+            <inputExclude>**/maven-eclipse.xml</inputExclude>
+            <inputExclude>**/*.iml</inputExclude>
+            <inputExclude>**/*.log</inputExclude>
+            <inputExclude>**/.externalToolBuilders/**</inputExclude>
+            <inputExclude>.git/**</inputExclude>
+            <inputExclude>.idea/**</inputExclude>
+            <inputExclude>**/.settings/**</inputExclude>
+            <inputExclude>**/.*</inputExclude>
+            <inputExclude>**/*.lst</inputExclude>
+            <inputExclude>**/*.json</inputExclude>
+            <inputExclude>**/*font*awesome*</inputExclude>
+            <inputExclude>**/banner.txt</inputExclude>
+            <inputExclude>**/target/**</inputExclude>
+          </inputExcludes>
         </configuration>
         <executions>
           <execution>

Reply via email to