[
https://issues.apache.org/jira/browse/SYNCOPE-2010?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18144290#comment-18144290
]
ASF subversion and git services commented on SYNCOPE-2010:
----------------------------------------------------------
Commit 0fa4f47d52165805a19b6a2cb168f98320a05b86 in syncope's branch
refs/heads/4_1_X from Gianpaolo
[ https://gitbox.apache.org/repos/asf?p=syncope.git;h=0fa4f47d52 ]
[SYNCOPE-2010] DefaultPasswordGenerator.merge() ignores usernameAllowed (#1606)
> DefaultPasswordGenerator#merge ignores usernameAllowed
> ------------------------------------------------------
>
> Key: SYNCOPE-2010
> URL: https://issues.apache.org/jira/browse/SYNCOPE-2010
> Project: Syncope
> Issue Type: Bug
> Components: core
> Affects Versions: 3.0.16, 4.0.9, 4.1.4
> Reporter: Francesco Chicchiriccò
> Assignee: Francesco Chicchiriccò
> Priority: Major
> Fix For: 4.1.5, 4.2.0, 5.0.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> h4. Problem
> {{DefaultPasswordGenerator.merge(List<DefaultPasswordRuleConf>)}} always
> returns a configuration with \{{usernameAllowed == true}}, even when every
> input configuration has {{{}usernameAllowed == false{}}}.
> h4. How to reproduce
> The test added in this PR fails on current {{master}} without the fix:
> {code:java}
> @Test
> void allForbid() {
> List<DefaultPasswordRuleConf> rules = new ArrayList();
> rules.add(configRule(false));
> rules.add(configRule(false));
> assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
> }
> {code}
> h4. Cause
> In {{{}merge{}}}, {{result}} is initialized with
> {{result.setUsernameAllowed(true)}}
> and is never set to {{false}} before the following check
> [https://github.com/apache/syncope/blob/193c94e019034071f13de4875d006377a3c5dac0/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java#L153-L155]
> {code:java}
> if (!result.isUsernameAllowed()) {
> result.setUsernameAllowed(ruleConf.isUsernameAllowed());
> }
> {code}
> The condition can therefore never be true, and the value of
> {{usernameAllowed}} in the input configurations is never read.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
