From fc044f6465084bdcc51096cfafdc19cb2fbf6113 Mon Sep 17 00:00:00 2001 From: gianpaolo-pestilli Date: Mon, 9 Nov 2026 13:40:28 +0100 Subject: [PATCH 1/3] Test improved: the new test spots a bug in DefaultPasswordGenerator.java --- .../spring/security/PasswordGeneratorTest.java | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java index 8927d4e0cbe..4ef6f5b0ae1 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java @@ -21,6 +21,7 @@ import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.junit.jupiter.api.Assertions.assertFalse; import java.util.List; import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf; @@ -31,6 +32,7 @@ import org.junit.jupiter.api.Test; import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; import tools.jackson.databind.json.JsonMapper; +import java.util.ArrayList; @SpringJUnitConfig(classes = { SpringTestConfiguration.class }) public class PasswordGeneratorTest { @@ -149,4 +151,19 @@ public void issueSYNCOPE678() { password = passwordGenerator.generate(List.of(new TestPasswordPolicy(passwordRule))); assertNotNull(password); } + + + private static DefaultPasswordRuleConf configRule(final boolean usernameAllowed) { + DefaultPasswordRuleConf conf = new DefaultPasswordRuleConf(); + conf.setUsernameAllowed(usernameAllowed); + return conf; + } + + @Test + void allForbid() { + List rules = new ArrayList(); + rules.add(configRule(false)); + rules.add(configRule(false)); + assertFalse(passwordGenerator.merge(rules).isUsernameAllowed()); + } } From 3ef2a6c37462f3a9ec37c68b664b23f4e8cc46f6 Mon Sep 17 00:00:00 2001 From: gianpaolo-pestilli Date: Mon, 9 Nov 2026 13:41:14 +0100 Subject: [PATCH 2/3] Patch: DefaultPasswordGenerator.java --- .../syncope/core/spring/security/DefaultPasswordGenerator.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java index 98e82b737ae..7a1ee5d38e7 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java @@ -150,7 +150,7 @@ protected DefaultPasswordRuleConf merge(final List defa result.setRepeatSame(ruleConf.getRepeatSame()); } - if (!result.isUsernameAllowed()) { + if (result.isUsernameAllowed()) { result.setUsernameAllowed(ruleConf.isUsernameAllowed()); } From 53a7d163aa0b258c9658f7c401eaaedf11da31bd Mon Sep 17 00:00:00 2001 From: gianpaolo-pestilli Date: Wed, 11 Nov 2026 17:43:53 +0100 Subject: [PATCH 3/3] I added some new test and fixed the <> in Arraylist --- .../security/PasswordGeneratorTest.java | 56 +++++++++++++++++-- 1 file changed, 52 insertions(+), 4 deletions(-) diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java index 4ef6f5b0ae1..78ffd833579 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java @@ -19,10 +19,11 @@ package org.apache.syncope.core.spring.security; import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; +import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertTrue; -import static org.junit.jupiter.api.Assertions.assertFalse; +import java.util.ArrayList; import java.util.List; import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; @@ -32,7 +33,7 @@ import org.junit.jupiter.api.Test; import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; import tools.jackson.databind.json.JsonMapper; -import java.util.ArrayList; + @SpringJUnitConfig(classes = { SpringTestConfiguration.class }) public class PasswordGeneratorTest { @@ -160,10 +161,57 @@ private static DefaultPasswordRuleConf configRule(final boolean usernameAllowed) } @Test - void allForbid() { - List rules = new ArrayList(); + public void allForbid() { + List rules = new ArrayList<>(); + rules.add(configRule(false)); + rules.add(configRule(false)); + assertFalse(passwordGenerator.merge(rules).isUsernameAllowed()); + } + + @Test + public void singleTrue() { + List rules = new ArrayList<>(); + rules.add(configRule(true)); + assertTrue(passwordGenerator.merge(rules).isUsernameAllowed()); + } + + @Test + public void singleFalse() { + List rules = new ArrayList<>(); rules.add(configRule(false)); + assertFalse(passwordGenerator.merge(rules).isUsernameAllowed()); + } + + @Test + public void twoTrue() { + List rules = new ArrayList<>(); + rules.add(configRule(true)); + rules.add(configRule(true)); + assertTrue(passwordGenerator.merge(rules).isUsernameAllowed()); + } + + @Test + public void trueThenFalse() { + List rules = new ArrayList<>(); + rules.add(configRule(true)); + rules.add(configRule(false)); + assertFalse(passwordGenerator.merge(rules).isUsernameAllowed()); + } + + @Test + public void falseThenTrue() { + List rules = new ArrayList<>(); + rules.add(configRule(false)); + rules.add(configRule(true)); + assertFalse(passwordGenerator.merge(rules).isUsernameAllowed()); + } + + @Test + public void falseInTheMiddle() { + List rules = new ArrayList<>(); + rules.add(configRule(true)); rules.add(configRule(false)); + rules.add(configRule(true)); assertFalse(passwordGenerator.merge(rules).isUsernameAllowed()); } }