[jira] [Commented] (OFBIZ-13658) Generate a longer password for the users created by the LinkedIn and GitHub login of the passport plugin

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OFBIZ-13658?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18124663#comment-18124663 ] 

ASF subversion and git services commented on OFBIZ-13658:
---------------------------------------------------------

Commit 04ba60ae17ef0f18370a5fb7d4318ee67c792b4d in ofbiz-plugins's branch refs/heads/release24.09 from Mridul Pathak
[ https://gitbox.apache.org/repos/asf?p=ofbiz-plugins.git;h=04ba60ae1 ]

Improved: Generate a longer password for the users created by the LinkedIn and GitHub login of the passport plugin (OFBIZ-13658)

GitHubEvents and LinkedInEvents set a generated password on the user login created for an external account, and the password had only as many characters as password.length.min (5 by default), which is much weaker than needed for a credential that stays valid on the account after the login.

The password is now generated with StringUtil.randomString and a fixed length of 16 characters, independent of password.length.min. The now unused RandomStringUtils and EntityUtilProperties imports and the private ALPHANUMERIC constant are removed.


> Generate a longer password for the users created by the LinkedIn and GitHub login of the passport plugin
> --------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-13658
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13658
>             Project: OFBiz
>          Issue Type: Bug
>          Components: passport
>    Affects Versions: Upcoming Branch, 24.09.07
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Minor
>
> GitHubEvents and LinkedInEvents of the passport plugin set a generated password on the user login created for an external account. The password has only as many characters as password.length.min (5 by default), so the generated credential is much weaker than it needs to be, and it stays valid on the account after the login.
> h3. Proposed change
> Generate the password with StringUtil.randomString and a fixed length of 16 or more characters, independent of password.length.min, in both classes, and drop the RandomStringUtils import.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)