[JBoss JIRA] Created: (GTNPORTAL-306) The User Handler implementation returns a User with a password "null"
2:49 a.m.
The User Handler implementation returns a User with a password "null"
---------------------------------------------------------------------
Key: GTNPORTAL-306
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-306
Project: GateIn Portal
Issue Type: Bug
Components: Identity integration
Affects Versions: 3.0.0-Beta02
Reporter: Trong Tran
Fix For: 3.0.0-Beta03
the unit test is in attached file testcase.diff
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:58 a.m.
New subject: [JBoss JIRA] Updated: (GTNPORTAL-306) The User Handler implementation returns a User with a password "null"
[
https://jira.jboss.org/jira/browse/GTNPORTAL-306?page=com.atlassian.jira....
]
Trong Tran updated GTNPORTAL-306:
---------------------------------
Attachment: testcase.diff
unit test for the user's password
The User Handler implementation returns a User with a password
"null"
---------------------------------------------------------------------
Key: GTNPORTAL-306
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-306
Project: GateIn Portal
Issue Type: Bug
Components: Identity integration
Affects Versions: 3.0.0-Beta02
Reporter: Trong Tran
Fix For: 3.0.0-Beta03
Attachments: testcase.diff
the unit test is in attached file testcase.diff
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:27 a.m.
New subject: [JBoss JIRA] Assigned: (GTNPORTAL-306) The User Handler implementation returns a User with a password "null"
[
https://jira.jboss.org/jira/browse/GTNPORTAL-306?page=com.atlassian.jira....
]
Trong Tran reassigned GTNPORTAL-306:
------------------------------------
Assignee: Boleslaw Dawidowicz
The User Handler implementation returns a User with a password
"null"
---------------------------------------------------------------------
Key: GTNPORTAL-306
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-306
Project: GateIn Portal
Issue Type: Bug
Components: Identity integration
Affects Versions: 3.0.0-Beta02
Reporter: Trong Tran
Assignee: Boleslaw Dawidowicz
Fix For: 3.0.0-Beta03
Attachments: testcase.diff
the unit test is in attached file testcase.diff
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:36 a.m.
New subject: [JBoss JIRA] Commented: (GTNPORTAL-306) The User Handler implementation returns a User with a password "null"
[
https://jira.jboss.org/jira/browse/GTNPORTAL-306?page=com.atlassian.jira....
]
Boleslaw Dawidowicz commented on GTNPORTAL-306:
-----------------------------------------------
PicketLinkIDMOrganizationServiceImpl has a 'passwordAsAttribute' switch that is
set to 'false' by default and can be set to true with ValueParam.
If true then password will be persisted as a plain text attribute and available in
user.getPassword(). By default it will be persisted as a user credential (encrypted) and
can be validated with the UserHandler.authentitcate() method.
The reason for this is that in some stores like LDAP which support user authentication
there is no way to grab unencrypted password but only to validate it by comparing one way
hash. IDM Hibernate store also supports such encrypted password hash. I provided the
'passwordAsAttribute' for compatibility reasons but I suggest to rethink using
user.getPassword() and rely on authenticate() instead...
The User Handler implementation returns a User with a password
"null"
---------------------------------------------------------------------
Key: GTNPORTAL-306
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-306
Project: GateIn Portal
Issue Type: Bug
Components: Identity integration
Affects Versions: 3.0.0-Beta02
Reporter: Trong Tran
Assignee: Boleslaw Dawidowicz
Fix For: 3.0.0-Beta03
Attachments: testcase.diff
the unit test is in attached file testcase.diff
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:22 p.m.
New subject: [JBoss JIRA] Resolved: (GTNPORTAL-306) The User Handler implementation returns a User with a password "null"
[
https://jira.jboss.org/jira/browse/GTNPORTAL-306?page=com.atlassian.jira....
]
Thomas Heute resolved GTNPORTAL-306.
------------------------------------
Resolution: Done
I modified the testcase:
Index: component/portal/src/test/java/org/exoplatform/portal/config/TestOrganization.java
===================================================================
---
component/portal/src/test/java/org/exoplatform/portal/config/TestOrganization.java (revision
817)
+++
component/portal/src/test/java/org/exoplatform/portal/config/TestOrganization.java (working
copy)
@@ -83,19 +83,19 @@
}
}
- public void testFindUserByUserName() throws Exception
+ public void testChangePassword() throws Exception
{
UserHandler uHandler = organizationService.getUserHandler();
User user = uHandler.findUserByName("root");
assertNotNull(user);
- assertEquals("gtn", user.getPassword());
+ assertTrue(uHandler.authenticate("root", "gtn"));
// Test changing password
user.setPassword("newPassword");
uHandler.saveUser(user, false);
user = uHandler.findUserByName("root");
assertNotNull(user);
- assertEquals("newPassword", user.getPassword());
+ assertTrue(uHandler.authenticate("root", "newPassword"));
// Reset to default password
user.setPassword("gtn");
As Bolek said user.getPassword() would not necessarily be able to return a password in
clear and shouldn't be used.
I fix the place where it was used to change current password, I will put a workaround the
password reminder, and add a Jira to rework on it for CR01.
Thanks
The User Handler implementation returns a User with a password
"null"
---------------------------------------------------------------------
Key: GTNPORTAL-306
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-306
Project: GateIn Portal
Issue Type: Bug
Components: Identity integration
Affects Versions: 3.0.0-Beta02
Reporter: Trong Tran
Assignee: Boleslaw Dawidowicz
Fix For: 3.0.0-Beta03
Attachments: testcase.diff
the unit test is in attached file testcase.diff
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:33 p.m.
New subject: [JBoss JIRA] Commented: (GTNPORTAL-306) The User Handler implementation returns a User with a password "null"
[
https://jira.jboss.org/jira/browse/GTNPORTAL-306?page=com.atlassian.jira....
]
Thomas Heute commented on GTNPORTAL-306:
----------------------------------------
In fact there is no need for a workaround in password reminder, there is already a
generation of a new (weak) password:
https://jira.jboss.org/jira/browse/GTNPORTAL-310
The User Handler implementation returns a User with a password
"null"
---------------------------------------------------------------------
Key: GTNPORTAL-306
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-306
Project: GateIn Portal
Issue Type: Bug
Components: Identity integration
Affects Versions: 3.0.0-Beta02
Reporter: Trong Tran
Assignee: Boleslaw Dawidowicz
Fix For: 3.0.0-Beta03
Attachments: testcase.diff
the unit test is in attached file testcase.diff
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:46 a.m.
New subject: [JBoss JIRA] Commented: (GTNPORTAL-306) The User Handler implementation returns a User with a password "null"
[
https://jira.jboss.org/jira/browse/GTNPORTAL-306?page=com.atlassian.jira....
]
Trong Tran commented on GTNPORTAL-306:
--------------------------------------
yes, i perfectly agree with that. we should not use user.getPassword() to get plain
password anymore.
The User Handler implementation returns a User with a password
"null"
---------------------------------------------------------------------
Key: GTNPORTAL-306
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-306
Project: GateIn Portal
Issue Type: Bug
Components: Identity integration
Affects Versions: 3.0.0-Beta02
Reporter: Trong Tran
Assignee: Boleslaw Dawidowicz
Fix For: 3.0.0-Beta03
Attachments: testcase.diff
the unit test is in attached file testcase.diff
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5333
days inactive
5334
days old
6 comments
3 participants
participants (3)
-
Boleslaw Dawidowicz (JIRA) -
Thomas Heute (JIRA)
-
Trong Tran (JIRA)