do not reset password for LDAP and SAML users or rehash on API calls (#2916)

src/Saml/User/SamlUserFactory.php

@@ -28,6 +28,7 @@ final class SamlUserFactory
         $user = new User();
         $user->setEnabled(true);
         $user->setUsername($token->getUsername());
+        $user->setPassword('');
 
         $this->hydrateUser($user, $token);
 
@@ -73,8 +74,11 @@ final class SamlUserFactory
         }
 
         // fill them after hydrating account, so they can't be overwritten
+        // by the mapping attributes
+        if ($user->getId() === null) {
+            $user->setPassword('');
+        }
         $user->setUsername($token->getUsername());
-        $user->setPassword('');
         $user->setAuth(User::AUTH_SAML);
     }