Find mixed-case usernames in InMemoryUserDetailsManager#changePassword

[junhyeong9812]

Overview

InMemoryUserDetailsManager.changePassword(...) fails for users whose username contains uppercase letters.

Problem

The manager keys its Map<String, MutableUserDetails> users on the lower-cased username in createUser, updateUser, deleteUser, userExists, loadUserByUsername, and updatePassword. Only changePassword(...) looked the current user up with the raw name:

String username = currentUser.getName();
...
MutableUserDetails user = this.users.get(username); // not lower-cased
Assert.state(user != null, "Current user doesn't exist in database.");

So a user created as e.g. User.withUsername("User")... (stored under the key "user") cannot change its password: users.get("User") is null and IllegalStateException("Current user doesn't exist in database.") is thrown, even though authentication and every other operation on that user succeed.

Fix

Lower-case the lookup key, matching the rest of the class:

MutableUserDetails user = this.users.get(username.toLowerCase(Locale.ROOT));

A regression test creates the manager with an uppercase username, authenticates as that user, and asserts changePassword(...) updates the password (observed through loadUserByUsername).

Closes gh-19336

[jzheaux]

Thanks, @junhyeong9812! This is now merged into 7.0.x and will go out in the next release.

[junhyeong9812]

Thanks for merging this, @jzheaux — and thank you for maintaining such a great framework. Happy to contribute back.