From 21dbfdb4f94ad25785cf753b405e131deb0fd29e Mon Sep 17 00:00:00 2001
From: Kevin Papst <kevinpapst@users.noreply.github.com>
Date: Wed, 10 Nov 2021 11:34:50 +0100
Subject: [PATCH] do not reset password for LDAP and SAML users or rehash on
 API calls (#2916)

---
 src/Ldap/LdapUserHydrator.php             |  6 ++++--
 src/Saml/User/SamlUserFactory.php         |  6 +++++-
 src/Security/TokenAuthenticator.php       | 12 +-----------
 tests/Security/TokenAuthenticatorTest.php | 16 ----------------
 4 files changed, 10 insertions(+), 30 deletions(-)

diff --git a/src/Ldap/LdapUserHydrator.php b/src/Ldap/LdapUserHydrator.php
index 4ca692b8..b81c9044 100644
--- a/src/Ldap/LdapUserHydrator.php
+++ b/src/Ldap/LdapUserHydrator.php
@@ -75,9 +75,11 @@ class LdapUserHydrator
         }
 
         // fill them after hydrating account, so they can't be overwritten
-        $user->setPassword('');
+        // by the mapping attributes
+        if ($user->getId() === null) {
+            $user->setPassword('');
+        }
         $user->setAuth(User::AUTH_LDAP);
-
         $user->setPreferenceValue('ldap.dn', $ldapEntry['dn']);
     }
 
diff --git a/src/Saml/User/SamlUserFactory.php b/src/Saml/User/SamlUserFactory.php
index 91b81e2d..b5d06a82 100644
--- a/src/Saml/User/SamlUserFactory.php
+++ b/src/Saml/User/SamlUserFactory.php
@@ -28,6 +28,7 @@ final class SamlUserFactory
         $user = new User();
         $user->setEnabled(true);
         $user->setUsername($token->getUsername());
+        $user->setPassword('');
 
         $this->hydrateUser($user, $token);
 
@@ -73,8 +74,11 @@ final class SamlUserFactory
         }
 
         // fill them after hydrating account, so they can't be overwritten
+        // by the mapping attributes
+        if ($user->getId() === null) {
+            $user->setPassword('');
+        }
         $user->setUsername($token->getUsername());
-        $user->setPassword('');
         $user->setAuth(User::AUTH_SAML);
     }
 
diff --git a/src/Security/TokenAuthenticator.php b/src/Security/TokenAuthenticator.php
index 90a7ae15..0854132d 100644
--- a/src/Security/TokenAuthenticator.php
+++ b/src/Security/TokenAuthenticator.php
@@ -19,9 +19,8 @@ use Symfony\Component\Security\Core\Exception\AuthenticationException;
 use Symfony\Component\Security\Core\User\UserInterface;
 use Symfony\Component\Security\Core\User\UserProviderInterface;
 use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;
-use Symfony\Component\Security\Guard\PasswordAuthenticatedInterface;
 
-class TokenAuthenticator extends AbstractGuardAuthenticator implements PasswordAuthenticatedInterface
+class TokenAuthenticator extends AbstractGuardAuthenticator
 {
     public const HEADER_USERNAME = 'X-AUTH-USER';
     public const HEADER_TOKEN = 'X-AUTH-TOKEN';
@@ -158,13 +157,4 @@ class TokenAuthenticator extends AbstractGuardAuthenticator implements PasswordA
     {
         return false;
     }
-
-    public function getPassword($credentials): ?string
-    {
-        if (!\is_array($credentials) || !\array_key_exists('token', $credentials) || empty($credentials['token'])) {
-            return null;
-        }
-
-        return $credentials['token'];
-    }
 }
diff --git a/tests/Security/TokenAuthenticatorTest.php b/tests/Security/TokenAuthenticatorTest.php
index 7b7149b6..e4bd452f 100644
--- a/tests/Security/TokenAuthenticatorTest.php
+++ b/tests/Security/TokenAuthenticatorTest.php
@@ -42,22 +42,6 @@ class TokenAuthenticatorTest extends TestCase
         self::assertFalse($sut->supports($request));
     }
 
-    public function testGetPassword()
-    {
-        $factory = $this->createMock(EncoderFactoryInterface::class);
-        $sut = new TokenAuthenticator($factory);
-
-        self::assertNull($sut->getPassword('asdfgh'));
-        self::assertNull($sut->getPassword(null));
-        self::assertNull($sut->getPassword([]));
-        self::assertNull($sut->getPassword(['password' => '1234567890']));
-        self::assertNull($sut->getPassword(['token' => null]));
-        self::assertNull($sut->getPassword(['token' => 0]));
-        self::assertNull($sut->getPassword(['token' => '']));
-        self::assertNull($sut->getPassword(['token' => false]));
-        self::assertEquals('foo-bar', $sut->getPassword(['token' => 'foo-bar']));
-    }
-
     public function testGetCredentials()
     {
         $factory = $this->createMock(EncoderFactoryInterface::class);