[SYNCOPE-646] Do not propagate password if not explicitely requested

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.2.2
• Fix Version/s: 1.2.3, 2.0.0-M1
• Component/s: core
• Assignee: Fabio Martelli
• Reporter: Fabio Martelli
• Created: 20/Feb/15 08:38
• Updated: 20/Mar/15 08:52
• Resolved: 20/Feb/15 10:51

Description

Currently, during propagation (CREATE or UPDATE) password will pe propagated (if and only if it is available) also in case it is not explicitely requested. This behavior has to be changed because it can cause unwanted password replaces in case of update operation.

1. change password encryption to AES.
2. change users password.
3. assigne resource: password is propagated as expected.
4. change some other attribute and saved: again the password is propagated. This is a potential problem: if user later change the password in the resource, syncope should not overwrite passowrd after that.

Issue Links

• is related to: SYNCOPE-383 Failure assigning resource to an existing user
• is related to: SYNCOPE-454 Update user without password specification involving resource with "Generate password if missing" enabled, sends password out anyway