LDAP updates user password on every login even if the password hasn't changed

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.X, 7.1.X, Master
• Fix Version/s: 7.0.0 DXP FP60, 7.0.0 DXP SP9, 7.0.X, 7.1.10 DXP FP3, 7.1.1 CE GA2, 7.1.10.1 SP1, 7.1.X, Master
• Component/s: Application Security > LDAP
• Labels:
  • INACTIVE
  • ee-ts
  • liferay-dxp-70-sp9
  • liferay-dxp-71-sp1
  • liferay-fixpack-de-60-7010
  • liferay-fixpack-dxp-3-7110
• Branch Version/s:
  7.1.x, 7.0.x
• Backported to Branch:
  Committed
• Story Points: 3
• Fix Priority: 4
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/63780

Steps to reproduce

1. Start a Docker container with OpenLDAP installed.

   docker run --name LPS-85179 --detach -p 389:389 holatuwol/liferayissue:LPS-85179
   docker exec -u root LPS-85179 apt-get update
   docker exec -u root LPS-85179 apt-get install -yq ldap-utils
   docker exec LPS-85179 ldapmodify -x -c -D 'cn=admin,cn=config' -w admin -f /postmodify.ldif
   

2. Set users.update.last.login=false in portal-ext.properties
3. Start up Liferay and log in as the admin user
4. Navigate to Control Panel > Configuration > Instance Settings
5. Select the Authentication section and select the LDAP tab
6. Choose the option to add an LDAP server
7. Test the LDAP configuration
   1. Set the name to "localhost"
   2. Select the OpenLDAP radio button
   3. Change the Base DN to "dc=example,dc=org"
   4. Change the Principal to "cn=test,ou=people,dc=example,dc=org"
   5. Change the password to "test"
   6. Click on the "Test LDAP Connection" button
8. Test the LDAP user import
   1. Click on the "Test LDAP Users" button
9. Save the configuration
10. Select the Authentication section and select the LDAP tab
11. Check the "Enabled" checkbox, the "Required" checkbox, and the "Enable User Password on Import"
12. Save the configuration, and double-check to make sure the settings took effect
13. Open a new shell window, and run the following script. If not using the provided OpenLDAP server, update the value for -u accordingly.

    while true
    do
        curl http://localhost:8080/api/jsonws/classname/fetch-class-name -u '[e-mail]:test' -d 'value=com.liferay.portal.kernel.model.User' 2>&1 | grep 'Exception
    done
    

14. Confirm that the script successfully runs successfully
15. Open a new shell window, and run the above script again (essentially having two shell windows running the script in parallel)

Expected Result: No StaleObjectStateExceptions are thrown in the Liferay logs
Actual Results: StaleObjectStateExceptions are thrown in the Liferay logs