Francesco Chicchiriccò created SYNCOPE-2010:
-----------------------------------------------
Summary: DefaultPasswordGenerator#merge ignores usernameAllowed
Key: SYNCOPE-2010
URL: https://issues.apache.org/jira/browse/SYNCOPE-2010
Project: Syncope
Issue Type: Bug
Components: core
Affects Versions: 4.1.4, 4.0.9, 3.0.16
Reporter: Francesco Chicchiriccò
Assignee: Francesco Chicchiriccò
Fix For: 4.1.5, 4.2.0, 5.0.0
h4. Problem
{{DefaultPasswordGenerator.merge(List<DefaultPasswordRuleConf>)}} always returns
a configuration with\{{usernameAllowed == true}}, even when every input
configuration has {{{}usernameAllowed == false{}}}.
h4. How to reproduce
The test added in this PR fails on current {{master}} without the fix:
{code:java}
@Test
void allForbid() {
List<DefaultPasswordRuleConf> rules = new ArrayList();
rules.add(configRule(false));
rules.add(configRule(false));
assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
}
{code}
h4. Cause
In {{{}merge{}}}, {{result}} is initialized with
{{result.setUsernameAllowed(true)}}
and is never set to {{false}} before the following check
[https://github.com/apache/syncope/blob/193c94e019034071f13de4875d006377a3c5dac0/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java#L153-L155]
{code:java}
if (!result.isUsernameAllowed()) {
result.setUsernameAllowed(ruleConf.isUsernameAllowed());
}
{code}
The condition can therefore never be true, and the value of {{usernameAllowed}}
in the input configurations is never read.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
