Create client with empty secret is not possible

[strehle]

What version of UAA are you running?

76.22.0

How are you deploying the UAA?

I am deploying the UAA

• locally only using gradlew
• using a bosh release I downloaded from bosh.io
• using cf-release
• using cf-deployment
• as part of a commercial Cloud Foundry distribution

What did you do?

uaac client add newclient --name xuaa --scope openid --authorized_grant_types password --autoapprove true --secret ''

error response:
{
"error": "invalid_client",
"error_description": "Client Secret must be at least 1 characters in length."
}

What did you expect to see? What goal are you trying to achieve with the UAA?

Create a client with an empty secret via REST

What did you see instead?

"Client Secret must be at least 1 characters in length."

The client secret policy by default allow a min length of 0 but in
https://github.com/cloudfoundry/uaa/blob/develop/server/src/main/java/org/cloudfoundry/identity/uaa/util/PasswordValidatorUtil.java#L55
This is prevented because this code "thinks" it runs for user passwords

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/186321885

The labels on this github issue will be updated when the story is started.

[peterhaochen47]

A similar discrepancy/confusion exists with the user password validation, in the context of uaa-release, where uaa.password.policy.minLength is defaulted to 0, but in reality, UAA does not allow zero-length user password.

But the addition of this "not allow zero-length password" logic seems deliberate based on the original tracker story associated with this restriction. Hence, we should investigate more before we attempt to unify the docs with the actual code. Perhaps the correct approach to eventually resolve this discrepancy is to, in a major release, maintain the API code logic (user/client cred needs to be at least 1 char), correct the docs/uaa-release config, and disallow empty string cred entirely.

[strehle]

A similar discrepancy/confusion exists with the user password validation, in the context of uaa-release, where uaa.password.policy.minLength is defaulted to 0, but in reality, UAA does not allow zero-length user password.

But the addition of this "not allow zero-length password" logic seems deliberate based on the original tracker story associated with this restriction. Hence, we should investigate more before we attempt to unify the docs with the actual code. Perhaps the correct approach to eventually resolve this discrepancy is to, in a major release, maintain the API code logic (user/client cred needs to be at least 1 char), correct the docs/uaa-release config, and disallow empty string cred entirely.

Thanks for referencing further issues here. This issue here will be found via search later on and can also serve for keeping in mind that we need to clarify the documentation and/or code