Fix using Authentication object for changing password
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 92
- Forks
- 81
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 46
Description
The current implementation uses LoginRequest as credentials in the Authentication object.
This is used to store data for password change. This approach is incorrect. The DTO about changing the password should be stored in the Authentication#details because it is not related to the credentials. Credentials should contain just information on how to authenticate. It could to an exception on BCrypt (used for dummy provider) because the length of the String is longer than 72 characters and the majority of providers expect String in there.
The suggested solution is to store as credentials only the current password and provide a new password as a detail in the Authentication object.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in apiml-security-common/src/main/java/org/zowe/apiml/security/common/login/LoginFilter.java at the authentication construction around lines 99-100, then trace how the password-change DTO is consumed. Verify that only the current password is used as credentials and the new password is available through Authentication details, including the dummy BCrypt provider behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100