diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java
index 98e82b737a..7a1ee5d38e 100644
--- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java
+++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java
@@ -150,7 +150,7 @@ protected DefaultPasswordRuleConf merge(final List<DefaultPasswordRuleConf> defa
                 result.setRepeatSame(ruleConf.getRepeatSame());
             }
 
-            if (!result.isUsernameAllowed()) {
+            if (result.isUsernameAllowed()) {
                 result.setUsernameAllowed(ruleConf.isUsernameAllowed());
             }
 
diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java
index 8927d4e0cb..78ffd83357 100644
--- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java
+++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java
@@ -19,9 +19,11 @@
 package org.apache.syncope.core.spring.security;
 
 import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import java.util.ArrayList;
 import java.util.List;
 import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf;
 import org.apache.syncope.core.provisioning.api.serialization.POJOHelper;
@@ -32,6 +34,7 @@
 import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
 import tools.jackson.databind.json.JsonMapper;
 
+
 @SpringJUnitConfig(classes = { SpringTestConfiguration.class })
 public class PasswordGeneratorTest {
 
@@ -149,4 +152,66 @@ public void issueSYNCOPE678() {
         password = passwordGenerator.generate(List.of(new TestPasswordPolicy(passwordRule)));
         assertNotNull(password);
     }
+
+    
+    private static DefaultPasswordRuleConf configRule(final boolean usernameAllowed) {
+        DefaultPasswordRuleConf conf = new DefaultPasswordRuleConf();
+        conf.setUsernameAllowed(usernameAllowed);
+        return conf;
+    }
+
+    @Test
+    public void allForbid() {
+        List<DefaultPasswordRuleConf> rules = new ArrayList<>();
+        rules.add(configRule(false));
+        rules.add(configRule(false));
+        assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
+    }
+
+    @Test
+    public void singleTrue() {
+        List<DefaultPasswordRuleConf> rules = new ArrayList<>();
+        rules.add(configRule(true));
+        assertTrue(passwordGenerator.merge(rules).isUsernameAllowed());
+    }
+
+    @Test
+    public void singleFalse() {
+        List<DefaultPasswordRuleConf> rules = new ArrayList<>();
+        rules.add(configRule(false));
+        assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
+    }
+
+    @Test
+    public void twoTrue() {
+        List<DefaultPasswordRuleConf> rules = new ArrayList<>();
+        rules.add(configRule(true));
+        rules.add(configRule(true));
+        assertTrue(passwordGenerator.merge(rules).isUsernameAllowed());
+    }
+
+    @Test
+    public void trueThenFalse() {
+        List<DefaultPasswordRuleConf> rules = new ArrayList<>();
+        rules.add(configRule(true));
+        rules.add(configRule(false));
+        assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
+    }
+
+    @Test
+    public void falseThenTrue() {
+        List<DefaultPasswordRuleConf> rules = new ArrayList<>();
+        rules.add(configRule(false));
+        rules.add(configRule(true));
+        assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
+    }
+
+    @Test
+    public void falseInTheMiddle() {
+        List<DefaultPasswordRuleConf> rules = new ArrayList<>();
+        rules.add(configRule(true));
+        rules.add(configRule(false));
+        rules.add(configRule(true));
+        assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
+    }
 }