[SYNCOPE-1966] Do not include security sensitive information in returned UserTO

client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/Constants.java

@@ -53,8 +53,6 @@ public final class Constants {
 
     public static final String NAME_FIELD_NAME = "name";
 
-    public static final String DEFAULT_TOKEN_FIELD_NAME = "token";
-
     public static final String ON_CLICK = "click";
 
     public static final String ON_DOUBLE_CLICK = "dblclick";

client/idrepo/console/src/main/java/org/apache/syncope/client/console/audit/AuditHistoryDetails.java

@@ -350,7 +350,6 @@ protected Model<String> toJSON(final AuditEventTO auditEvent, final Class<T> ref
                     readValue(content, reference);
             if (entity instanceof UserTO userTO) {
                 userTO.setPassword(null);
-                userTO.setSecurityAnswer(null);
             }
 
             return Model.of(MAPPER.writerWithDefaultPrettyPrinter().writeValueAsString(entity));

client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/AnyDirectoryPanel.java

@@ -41,7 +41,6 @@
 import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.BooleanPropertyColumn;
 import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.DatePropertyColumn;
 import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.KeyPropertyColumn;
-import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.TokenColumn;
 import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal;
 import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink;
 import org.apache.syncope.client.console.wizards.any.StatusPanel;
@@ -222,8 +221,6 @@ protected void addPropertyColumn(
 
         if (Constants.KEY_FIELD_NAME.equalsIgnoreCase(name)) {
             columns.add(new KeyPropertyColumn<>(new ResourceModel(name, name), name, name));
-        } else if (Constants.DEFAULT_TOKEN_FIELD_NAME.equalsIgnoreCase(name)) {
-            columns.add(new TokenColumn<>(new ResourceModel(name, name), name));
         } else if (field != null && !field.isSynthetic()
                 && (field.getType().equals(Boolean.class) || field.getType().equals(boolean.class))) {
 

client/idrepo/console/src/main/java/org/apache/syncope/client/console/wizards/any/UserInformationPanel.java

@@ -53,21 +53,5 @@ public <T extends AnyTO> UserInformationPanel(final String id, final UserTO user
         // ------------------------
         add(new Label("failedLogins", new Model<>(userTO.getFailedLogins())));
         // ------------------------
-
-        // ------------------------
-        // Token
-        // ------------------------
-        add(new Label("token", new Model<>(userTO.getToken() == null
-                ? StringUtils.EMPTY
-                : userTO.getToken())));
-        // ------------------------
-
-        // ------------------------
-        // Token expire time
-        // ------------------------
-        add(new Label("tokenExpireTime", new Model<>(userTO.getTokenExpireTime() == null
-                ? StringUtils.EMPTY
-                : SyncopeConsoleSession.get().getDateFormat().format(userTO.getTokenExpireTime()))));
-        // ------------------------
     }
 }

client/idrepo/console/src/main/resources/org/apache/syncope/client/console/wizards/any/UserInformationPanel.html

@@ -28,10 +28,6 @@
           <dd class="col-sm-6"><span wicket:id="failedLogins"/></dd>
           <dt class="col-sm-6"><wicket:message key="changePwdDate"/></dt>
           <dd class="col-sm-6"><span wicket:id="changePwdDate"/></dd>
-          <dt class="col-sm-6"><wicket:message key="tokenExpireTime"/></dt>
-          <dd class="col-sm-6"><span wicket:id="tokenExpireTime"/></dd>
-          <dt class="col-sm-6"><wicket:message key="token"/></dt>
-          <dd class="col-sm-6"><span wicket:id="token"/></dd>
         </dl>
       </div>
       <!-- /.card-body -->

common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java

@@ -26,7 +26,6 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 import org.apache.commons.lang3.SerializationUtils;
-import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.request.AbstractReplacePatchItem;
 import org.apache.syncope.common.lib.request.AnyObjectUR;
@@ -300,13 +299,9 @@ public static UserUR diff(final UserTO updated, final UserTO original, final boo
         if (updated.getSecurityQuestion() == null) {
             result.setSecurityQuestion(null);
             result.setSecurityAnswer(null);
-        } else if (!updated.getSecurityQuestion().equals(original.getSecurityQuestion())
-                || StringUtils.isNotBlank(updated.getSecurityAnswer())) {
-
+        } else if (!updated.getSecurityQuestion().equals(original.getSecurityQuestion())) {
             result.setSecurityQuestion(new StringReplacePatchItem.Builder().
                     value(updated.getSecurityQuestion()).build());
-            result.setSecurityAnswer(
-                    new StringReplacePatchItem.Builder().value(updated.getSecurityAnswer()).build());
         }
 
         result.setMustChangePassword(replacePatchItem(

common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/EntityTOUtils.java

@@ -76,7 +76,6 @@ public static <A extends AnyTO, C extends AnyCR> void toAnyCR(final A anyTO, fin
             userCR.setUsername(userTO.getUsername());
             userCR.setPassword(userTO.getPassword());
             userCR.setSecurityQuestion(userTO.getSecurityQuestion());
-            userCR.setSecurityAnswer(userTO.getSecurityAnswer());
             userCR.setMustChangePassword(userTO.isMustChangePassword());
             userCR.getMemberships().addAll(userTO.getMemberships());
             userCR.getRoles().addAll(userTO.getRoles());
@@ -103,7 +102,6 @@ public static <C extends AnyCR, A extends AnyTO> void toAnyTO(final C anyCR, fin
             userTO.setUsername(userCR.getUsername());
             userTO.setPassword(userCR.getPassword());
             userTO.setSecurityQuestion(userCR.getSecurityQuestion());
-            userTO.setSecurityAnswer(userCR.getSecurityAnswer());
             userTO.setMustChangePassword(userCR.isMustChangePassword());
             userTO.getMemberships().addAll(userCR.getMemberships());
             userTO.getRoles().addAll(userCR.getRoles());

common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java

@@ -34,14 +34,10 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
 
     private static final long serialVersionUID = 7791304495192615740L;
 
-    private String password;
-
-    private String token;
-
-    private OffsetDateTime tokenExpireTime;
-
     private String username;
 
+    private String password;
+
     private OffsetDateTime lastLoginDate;
 
     private OffsetDateTime changePwdDate;
@@ -50,8 +46,6 @@ public class UserTO extends AnyTO implements GroupableRelatableTO {
 
     private String securityQuestion;
 
-    private String securityAnswer;
-
     private boolean suspended;
 
     private boolean mustChangePassword;
@@ -84,30 +78,6 @@ public void setType(final String type) {
         // fixed
     }
 
-    public String getPassword() {
-        return password;
-    }
-
-    public void setPassword(final String password) {
-        this.password = password;
-    }
-
-    public String getToken() {
-        return token;
-    }
-
-    public void setToken(final String token) {
-        this.token = token;
-    }
-
-    public OffsetDateTime getTokenExpireTime() {
-        return tokenExpireTime;
-    }
-
-    public void setTokenExpireTime(final OffsetDateTime tokenExpireTime) {
-        this.tokenExpireTime = tokenExpireTime;
-    }
-
     @JsonProperty(required = true)
     public String getUsername() {
         return username;
@@ -117,6 +87,14 @@ public void setUsername(final String username) {
         this.username = username;
     }
 
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(final String password) {
+        this.password = password;
+    }
+
     public OffsetDateTime getChangePwdDate() {
         return changePwdDate;
     }
@@ -149,14 +127,6 @@ public void setSecurityQuestion(final String securityQuestion) {
         this.securityQuestion = securityQuestion;
     }
 
-    public String getSecurityAnswer() {
-        return securityAnswer;
-    }
-
-    public void setSecurityAnswer(final String securityAnswer) {
-        this.securityAnswer = securityAnswer;
-    }
-
     public boolean isSuspended() {
         return suspended;
     }
@@ -208,13 +178,10 @@ public int hashCode() {
                 appendSuper(super.hashCode()).
                 append(username).
                 append(roles).
-                append(token).
-                append(tokenExpireTime).
                 append(lastLoginDate).
                 append(changePwdDate).
                 append(failedLogins).
                 append(securityQuestion).
-                append(securityAnswer).
                 append(suspended).
                 append(mustChangePassword).
                 append(memberships).
@@ -240,13 +207,10 @@ public boolean equals(final Object obj) {
                 appendSuper(super.equals(obj)).
                 append(username, other.username).
                 append(roles, other.roles).
-                append(token, other.token).
-                append(tokenExpireTime, other.tokenExpireTime).
                 append(lastLoginDate, other.lastLoginDate).
                 append(changePwdDate, other.changePwdDate).
                 append(failedLogins, other.failedLogins).
                 append(securityQuestion, other.securityQuestion).
-                append(securityAnswer, other.securityAnswer).
                 append(suspended, other.suspended).
                 append(mustChangePassword, other.mustChangePassword).
                 append(memberships, other.memberships).

common/keymaster/client-api/src/main/java/org/apache/syncope/common/keymaster/client/api/StandardConfParams.java

@@ -34,8 +34,6 @@ public final class StandardConfParams {
 
     public static final String PASSWORD_CIPHER_ALGORITHM = "password.cipher.algorithm";
 
-    public static final String RETURN_PASSWORD_VALUE = "return.password.value";
-
     public static final String AUTHENTICATION_ATTRIBUTES = "authentication.attributes";
 
     public static final String AUTHENTICATION_STATUSES = "authentication.statuses";

common/keymaster/client-api/src/main/resources/defaultKeymasterConfParams.json

@@ -9,7 +9,6 @@
   "authentication.attributes": ["username"],
   "authentication.statuses": ["created", "active"],
   "log.lastlogindate": true,
-  "return.password.value": false,
   "jwt.lifetime.minutes": 120,
   "connector.conf.history.size": 10,
   "resource.conf.history.size": 10

common/keymaster/client-zookeeper/src/test/java/org/apache/syncope/common/keymaster/client/zookeeper/ZookeeperConfParamOpsITCase.java

@@ -67,9 +67,10 @@ public void get() {
         assertNotNull(dateValue);
         assertEquals(new Date(1554982140000L), dateValue);
 
-        Boolean booleanValue = confParamOps.get(DOMAIN, StandardConfParams.RETURN_PASSWORD_VALUE, null, Boolean.class);
+        Boolean booleanValue = confParamOps.get(
+                DOMAIN, StandardConfParams.SELF_REGISTRATION_ALLOWED, null, Boolean.class);
         assertNotNull(booleanValue);
-        assertEquals(false, booleanValue);
+        assertEquals(true, booleanValue);
 
         List<String> stringValues = List.of(confParamOps.get(
                 DOMAIN, StandardConfParams.AUTHENTICATION_STATUSES, null, String[].class));

common/keymaster/client-zookeeper/src/test/resources/testKeymasterConfParams.json

@@ -11,7 +11,6 @@
   "authentication.attributes": ["username"],
   "authentication.statuses": ["created", "active"],
   "log.lastlogindate": true,
-  "return.password.value": false,
   "jwt.lifetime.minutes": 120,
   "connector.conf.history.size": 10,
   "resource.conf.history.size": 10,

core/persistence-jpa/src/main/resources/domains/MasterKeymasterConfParams.json

@@ -11,7 +11,6 @@
   "authentication.attributes": ["username"],
   "authentication.statuses": ["created", "active"],
   "log.lastlogindate": true,
-  "return.password.value": false,
   "jwt.lifetime.minutes": 120,
   "connector.conf.history.size": 10,
   "resource.conf.history.size": 10