Skip to content

[SYNCOPE-2010] DefaultPasswordGenerator.merge() ignores usernameAllowed #1606

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ilgrosso merged 3 commits into from
Nov 13, 2026
Merged

[SYNCOPE-2010] DefaultPasswordGenerator.merge() ignores usernameAllowed #1606

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fc044f6
Test improved: the new test spots a bug in DefaultPasswordGenerator.java
gianpaolo-pestilli Nov 9, 2026
3ef2a6c
Patch: DefaultPasswordGenerator.java
gianpaolo-pestilli Nov 9, 2026
53a7d16
I added some new test and fixed the <> in Arraylist
gianpaolo-pestilli Nov 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...pring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,7 @@ protected DefaultPasswordRuleConf merge(final List<DefaultPasswordRuleConf> defa
result.setRepeatSame(ruleConf.getRepeatSame());
}

if (!result.isUsernameAllowed()) {
if (result.isUsernameAllowed()) {
result.setUsernameAllowed(ruleConf.isUsernameAllowed());
}

Expand Down
65 changes: 65 additions & 0 deletions core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,11 @@
package org.apache.syncope.core.spring.security;

import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertTrue;

import java.util.ArrayList;
import java.util.List;
import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf;
import org.apache.syncope.core.provisioning.api.serialization.POJOHelper;
Expand All @@ -32,6 +34,7 @@
import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
import tools.jackson.databind.json.JsonMapper;


@SpringJUnitConfig(classes = { SpringTestConfiguration.class })
public class PasswordGeneratorTest {

Expand Down Expand Up @@ -149,4 +152,66 @@ public void issueSYNCOPE678() {
password = passwordGenerator.generate(List.of(new TestPasswordPolicy(passwordRule)));
assertNotNull(password);
}


private static DefaultPasswordRuleConf configRule(final boolean usernameAllowed) {
DefaultPasswordRuleConf conf = new DefaultPasswordRuleConf();
conf.setUsernameAllowed(usernameAllowed);
return conf;
}

@Test
Comment thread
ilgrosso marked this conversation as resolved.
Resolved
public void allForbid() {
List<DefaultPasswordRuleConf> rules = new ArrayList<>();
rules.add(configRule(false));
rules.add(configRule(false));
assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
}

@Test
public void singleTrue() {
List<DefaultPasswordRuleConf> rules = new ArrayList<>();
rules.add(configRule(true));
assertTrue(passwordGenerator.merge(rules).isUsernameAllowed());
}

@Test
public void singleFalse() {
List<DefaultPasswordRuleConf> rules = new ArrayList<>();
rules.add(configRule(false));
assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
}

@Test
public void twoTrue() {
List<DefaultPasswordRuleConf> rules = new ArrayList<>();
rules.add(configRule(true));
rules.add(configRule(true));
assertTrue(passwordGenerator.merge(rules).isUsernameAllowed());
}

@Test
public void trueThenFalse() {
List<DefaultPasswordRuleConf> rules = new ArrayList<>();
rules.add(configRule(true));
rules.add(configRule(false));
assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
}

@Test
public void falseThenTrue() {
List<DefaultPasswordRuleConf> rules = new ArrayList<>();
rules.add(configRule(false));
rules.add(configRule(true));
assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
}

@Test
public void falseInTheMiddle() {
List<DefaultPasswordRuleConf> rules = new ArrayList<>();
rules.add(configRule(true));
rules.add(configRule(false));
rules.add(configRule(true));
assertFalse(passwordGenerator.merge(rules).isUsernameAllowed());
}
}