do not reset password for LDAP and SAML users or rehash on API calls (#2916)

src/Ldap/LdapUserHydrator.php

@@ -75,9 +75,11 @@ class LdapUserHydrator
         }
 
         // fill them after hydrating account, so they can't be overwritten
+        // by the mapping attributes
+        if ($user->getId() === null) {
             $user->setPassword('');
+        }
         $user->setAuth(User::AUTH_LDAP);
-
         $user->setPreferenceValue('ldap.dn', $ldapEntry['dn']);
     }
 

src/Saml/User/SamlUserFactory.php

@@ -28,6 +28,7 @@ final class SamlUserFactory
         $user = new User();
         $user->setEnabled(true);
         $user->setUsername($token->getUsername());
+        $user->setPassword('');
 
         $this->hydrateUser($user, $token);
 
@@ -73,8 +74,11 @@ final class SamlUserFactory
         }
 
         // fill them after hydrating account, so they can't be overwritten
-        $user->setUsername($token->getUsername());
+        // by the mapping attributes
+        if ($user->getId() === null) {
             $user->setPassword('');
+        }
+        $user->setUsername($token->getUsername());
         $user->setAuth(User::AUTH_SAML);
     }
 

src/Security/TokenAuthenticator.php

@@ -19,9 +19,8 @@ use Symfony\Component\Security\Core\Exception\AuthenticationException;
 use Symfony\Component\Security\Core\User\UserInterface;
 use Symfony\Component\Security\Core\User\UserProviderInterface;
 use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;
-use Symfony\Component\Security\Guard\PasswordAuthenticatedInterface;
 
-class TokenAuthenticator extends AbstractGuardAuthenticator implements PasswordAuthenticatedInterface
+class TokenAuthenticator extends AbstractGuardAuthenticator
 {
     public const HEADER_USERNAME = 'X-AUTH-USER';
     public const HEADER_TOKEN = 'X-AUTH-TOKEN';
@@ -158,13 +157,4 @@ class TokenAuthenticator extends AbstractGuardAuthenticator implements PasswordA
     {
         return false;
     }
-
-    public function getPassword($credentials): ?string
-    {
-        if (!\is_array($credentials) || !\array_key_exists('token', $credentials) || empty($credentials['token'])) {
-            return null;
-        }
-
-        return $credentials['token'];
-    }
 }

tests/Security/TokenAuthenticatorTest.php

@@ -42,22 +42,6 @@ class TokenAuthenticatorTest extends TestCase
         self::assertFalse($sut->supports($request));
     }
 
-    public function testGetPassword()
-    {
-        $factory = $this->createMock(EncoderFactoryInterface::class);
-        $sut = new TokenAuthenticator($factory);
-
-        self::assertNull($sut->getPassword('asdfgh'));
-        self::assertNull($sut->getPassword(null));
-        self::assertNull($sut->getPassword([]));
-        self::assertNull($sut->getPassword(['password' => '1234567890']));
-        self::assertNull($sut->getPassword(['token' => null]));
-        self::assertNull($sut->getPassword(['token' => 0]));
-        self::assertNull($sut->getPassword(['token' => '']));
-        self::assertNull($sut->getPassword(['token' => false]));
-        self::assertEquals('foo-bar', $sut->getPassword(['token' => 'foo-bar']));
-    }
-
     public function testGetCredentials()
     {
         $factory = $this->createMock(EncoderFactoryInterface::class);