[
https://issues.apache.org/jira/browse/OAK-8408?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
angela updated OAK-8408:
------------------------
Summary: UserImporter must not trigger creation of rep:pwd node unless
included in xml (initial-pw-change) (was: UserImporter must not trigger
creation of rep:pwd node unless included in xml)
> UserImporter must not trigger creation of rep:pwd node unless included in xml
> (initial-pw-change)
> -------------------------------------------------------------------------------------------------
>
> Key: OAK-8408
> URL: https://issues.apache.org/jira/browse/OAK-8408
> Project: Jackrabbit Oak
> Issue Type: Improvement
> Components: core, security
> Reporter: angela
> Assignee: angela
> Priority: Major
> Attachments: OAK-8408-tests.patch, OAK-8408.patch
>
>
> when xml-importing an existing user (i.e. {{Tree}} doesn't have status NEW
> upon import) calling {{UserManagerImpl.setPassword}} will force the creation
> of the {{rep:pwd}} node and {{rep:passwordLastModified}} property contained
> therein _if_ theinitial-password-change feature is enabled.
> imo the {{rep:pwd}} (and any properties contained therein) must not be
> auto-created by should only be imported if contained in the XML.
> proposed fix: {{UserManagerImpl.setPassword}} already contains special
> treatment for the password hashing triggered upon xml import -> renaming that
> flag and respect it for the handling of the pw last modified.
> [~stillalex], wdyt?
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
