make password an optional parameter/field in createAccount by DaanHoogland · Pull Request #13955 · apache/cloudstack

DaanHoogland · 2026-08-22T21:07:13Z

Description

This PR...

Fixes: #12039

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

codecov · 2026-08-22T21:16:03Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 20.78%. Comparing base (f3cb957) to head (3b3010f).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##               main   #13955    +/-   ##
==========================================
  Coverage     20.78%   20.78%            
- Complexity    21928    21944    +16     
==========================================
  Files          6496     6496            
  Lines        591657   591828   +171     
  Branches      72592    72619    +27     
==========================================
+ Hits         122956   123032    +76     
- Misses       455356   455442    +86     
- Partials      13345    13354     +9

Flag	Coverage Δ
uitests	`3.88% <ø> (-0.01%)`	⬇️
unittests	`22.09% <100.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-08-22T22:09:41Z

🔴 Test Coverage Grade: `D` — Marginal

Metric	Value
Line coverage	25.89%
Branch coverage	20.23%

Grade Scale

Grade	Line Coverage	Meaning
🟢 A	≥ 80%	Excellent - this code sleeps well at night 😴
🟡 B	60-79%	Good - almost there, don't stop now 😉
🟠 C	40-59%	Acceptable - your code is wearing a seatbelt, but no airbags 😬
🔴 D	20-39%	Marginal - boldly shipping where no test has gone before 🖖
⛔ F	< 20%	Failing - tests? what tests? 🔥

Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run

GaOrtiga

LGTM

DaanHoogland · 2026-08-25T17:00:57Z

@blueorangutan package

blueorangutan · 2026-08-25T17:02:04Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-08-25T17:53:23Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18980

DaanHoogland · 2026-08-26T11:07:32Z

LGTM

@GaOrtiga did you happen to test?

DaanHoogland · 2026-08-26T11:08:10Z

@blueorangutan test

vishesh92

just one comment. rest looks good.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Updates account creation to allow omitting a password (notably for externally authenticated accounts like SAML/LDAP), and reflects that behavior in the UI and API validation.

Changes:

UI: Hide password inputs when SAML is enabled, show informational message, and relax validation rules accordingly.
API: Make password optional for createAccount and auto-generate a random password when absent/blank.
Tests: Update CreateAccountCmdTest expectations around null/empty passwords.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
ui/src/views/iam/AddAccount.vue	Conditionally hides password fields for SAML and updates client-side validation + request params.
ui/public/locales/en.json	Adds i18n string explaining that no password is needed for SAML accounts.
api/src/main/java/org/apache/cloudstack/api/command/admin/account/CreateAccountCmd.java	Makes password optional and generates a random password when blank.
api/src/test/java/org/apache/cloudstack/api/command/admin/account/CreateAccountCmdTest.java	Adjusts unit tests for the new password generation behavior.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

sonarqubecloud · 2026-09-09T18:15:09Z

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
66.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

blueorangutan · 2026-09-09T18:43:38Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19184

…unt/CreateAccountCmd.java Co-authored-by: GaOrtiga <49285692+GaOrtiga@users.noreply.github.com>

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

6 open issues

The password fields are hidden when form.samlenable is initially true, but this watcher won’t run… · New
The password fields are hidden when form.samlenable is initially true, but this watcher won’t run… · New
Generating a random password whenever the client omits password changes the API semantics for all… · New
Generating a random password whenever the client omits password changes the API semantics for all… · New
Generating a random password whenever the client omits password changes the API semantics for all… · New
This test validates password generation, but it asserts an INTERNAL_ERROR that occurs only… · New

4 resolved since last review

_{Review effort: Lite}

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

2 open issues

This watcher updates form validation rules when form.samlenable changes, but it does not run on… · New
There’s an extra trailing space at the end of the first string literal (\"... Docs section. \")… · New

6 resolved since last review

_{Review effort: Lite}

+    'form.samlenable' (samlEnabled) {
+      // a SAML-authenticated account never logs in with a native password
+      this.rules.password = samlEnabled ? [] : [{ required: true, message: this.$t('message.error.required.input') }]
+      this.rules.confirmpassword = samlEnabled ? [] : [
+        { required: true, message: this.$t('message.error.required.input') },
+        { validator: this.validateConfirmPassword }
+      ]
    }


nvazquez · 2026-11-10T03:04:02Z

@blueorangutan package

nvazquez

Code LGTM - just this minor issue: extra space is not needed

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

DaanHoogland · 2026-11-10T10:13:26Z

@blueorangutan package

blueorangutan · 2026-11-10T10:14:05Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

4 open issues

The UI logic toggles behavior based on values.samlenable, but samlenable is not included in… · New
The concatenated description string is missing a space between sentences, resulting in `section.If… · New
This watcher won’t run on initial render, so rules.password / rules.confirmpassword may remain… · New
This watcher updates form validation rules when form.samlenable changes, but it does not run on…

1 resolved since last review

There’s an extra trailing space at the end of the first string literal (\"... Docs section. \")…

_{Review effort: Lite}

        const params = {
          roleid: values.roleid,
          username: values.username,
-          password: values.password,
          email: values.email,
          firstname: values.firstname,
          lastname: values.lastname,
          domainid: values.domainid
        }
+        if (!values.samlenable) {
+          // SAML-authenticated accounts never log in with a native password; let the API
+          // generate one rather than asking the admin to set one that will never be used
+          params.password = values.password
+        }


+    'form.samlenable' (samlEnabled) {
+      // a SAML-authenticated account never logs in with a native password
+      this.rules.password = samlEnabled ? [] : [{ required: true, message: this.$t('message.error.required.input') }]
+      this.rules.confirmpassword = samlEnabled ? [] : [
+        { required: true, message: this.$t('message.error.required.input') },
+        { validator: this.validateConfirmPassword }
+      ]
    }


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

8 open issues

This watcher only runs when form.samlenable changes; if the form loads with samlenable === true… · New
The UI logic toggles behavior based on values.samlenable, but samlenable is not included in…
The generated password length is a hard-coded magic number (12). To keep behavior consistent with… · New
The generated password length is a hard-coded magic number (12). To keep behavior consistent with… · New
The decision to omit params.password depends on values.samlenable, but the UI… · New
This watcher won’t run on initial render, so rules.password / rules.confirmpassword may remain…
This watcher updates form validation rules when form.samlenable changes, but it does not run on…
The test duplicates the generated password length (12), which can become brittle if the… · New

1 resolved since last review

The concatenated description string is missing a space between sentences, resulting in `section.If…

_{Review effort: Lite}

+    'form.samlenable' (samlEnabled) {
+      // a SAML-authenticated account never logs in with a native password
+      this.rules.password = samlEnabled ? [] : [{ required: true, message: this.$t('message.error.required.input') }]
+      this.rules.confirmpassword = samlEnabled ? [] : [
+        { required: true, message: this.$t('message.error.required.input') },
+        { validator: this.validateConfirmPassword }
+      ]


+    private static final int GENERATED_PASSWORD_LENGTH = 12;



-        if(StringUtils.isEmpty(getPassword())) {
-            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Empty passwords are not allowed");
+        if (getPassword() == null) {
+            password = PasswordGenerator.generateRandomPassword(GENERATED_PASSWORD_LENGTH);


        const params = {
          roleid: values.roleid,
          username: values.username,
-          password: values.password,
          email: values.email,
          firstname: values.firstname,
          lastname: values.lastname,
          domainid: values.domainid
        }
+        if (!values.samlenable) {
+          // SAML-authenticated accounts never log in with a native password; let the API
+          // generate one rather than asking the admin to set one that will never be used


+        Assert.assertEquals("a password should be generated for accounts that authenticate externally",
+                12, createAccountCmd.getPassword().length());


Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

11 open issues

This watcher only runs when form.samlenable changes; if the form loads with samlenable === true…
The UI logic toggles behavior based on values.samlenable, but samlenable is not included in…
The PR description template is largely unfilled (types of change, severity, and testing sections).… · New
A new i18n key is added only in en.json. If the UI ships with additional locales, users on those… · New
This watcher won’t run on initial render, so if form.samlenable is initialized to true (e.g.,… · New
The decision to omit params.password depends on values.samlenable, but the UI…
The generated password length is a hard-coded magic number (12). To keep behavior consistent with…
The generated password length is a hard-coded magic number (12). To keep behavior consistent with…
This watcher won’t run on initial render, so rules.password / rules.confirmpassword may remain…
This watcher updates form validation rules when form.samlenable changes, but it does not run on…
The test duplicates the generated password length (12), which can become brittle if the…

_{Review effort: Lite}

+               description = "Clear text password (Default hashed to SHA256SALT). If you wish to use any other hashing algorithm, you will need to write a custom authentication adapter. See Docs section."
+                       + " If omitted, a random password is generated, e.g. for an account that will only ever authenticate externally via SAML/LDAP.")


 "message.restart.vpc": "Please confirm that you want to restart the VPC.",
 "message.restart.vpc.remark": "Please confirm that you want to restart the VPC <p><i>Remark: making a non-redundant VPC redundant will force a clean up. The Networks will not be available for a couple of minutes</i>.</p>",
 "message.running.custom.action": "Running action",
+"message.saml.account.no.password": "This account will authenticate via SAML SSO, so no password is needed — one will be generated automatically.",


+    'form.samlenable' (samlEnabled) {
+      // a SAML-authenticated account never logs in with a native password
+      this.rules.password = samlEnabled ? [] : [{ required: true, message: this.$t('message.error.required.input') }]
+      this.rules.confirmpassword = samlEnabled ? [] : [
+        { required: true, message: this.$t('message.error.required.input') },
+        { validator: this.validateConfirmPassword }
+      ]


blueorangutan · 2026-11-10T11:53:39Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19970

DaanHoogland · 2026-11-10T12:20:09Z

@blueorangutan test

blueorangutan · 2026-11-10T12:22:15Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

sonarqubecloud · 2026-11-10T12:31:46Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
66.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

blueorangutan · 2026-11-11T08:47:42Z

[SF] Trillian test result (tid-17534)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 69342 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13955-t17534-kvm-ol8.zip
Smoke tests completed. 154 look OK, 3 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_01_primary_storage_nfs	`Error`	0.33	test_primary_storage.py
ContextSuite context=TestStorageTags>:setup	`Error`	0.52	test_primary_storage.py
test_01_primary_storage_scope_change	`Error`	0.23	test_primary_storage_scope.py
test_02_list_cpvm_vm	`Failure`	0.06	test_ssvm.py
test_04_cpvm_internals	`Failure`	0.06	test_ssvm.py
test_12_destroy_cpvm	`Error`	3.29	test_ssvm.py

RosiKyu · 2026-11-12T22:18:11Z

@blueorangutan test

blueorangutan · 2026-11-12T22:20:05Z

@RosiKyu a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

DaanHoogland added this to the 4.24.0 milestone Aug 22, 2026

boring-cyborg Bot added component:api component:UI labels Aug 22, 2026

GaOrtiga approved these changes Aug 24, 2026

View reviewed changes

Comment thread api/src/main/java/org/apache/cloudstack/api/command/admin/account/CreateAccountCmd.java Resolved

DaanHoogland force-pushed the ghi12039-optional-password-for-saml-account branch from 86b71c7 to 7fba665 Compare August 25, 2026 17:00

DaanHoogland added this to CloudStack Testing Aug 25, 2026

github-project-automation Bot moved this to Backlog in CloudStack Testing Aug 25, 2026

DaanHoogland added the status:needs-testing label Aug 25, 2026

DaanHoogland requested review from Pearl1594 and RosiKyu August 26, 2026 11:08

DaanHoogland moved this from Backlog to Ready in CloudStack Testing Aug 31, 2026

vishesh92 reviewed Sep 9, 2026

View reviewed changes

Comment thread api/src/main/java/org/apache/cloudstack/api/command/admin/account/CreateAccountCmd.java Resolved

vishesh92 approved these changes Sep 9, 2026

View reviewed changes

Copilot AI lite review requested due to automatic review settings September 9, 2026 17:06

Copilot AI reviewed Sep 9, 2026

View reviewed changes

Copilot started reviewing on behalf of DaanHoogland September 9, 2026 20:40

View session

DaanHoogland and others added 4 commits November 9, 2026 13:03

make password an optional parameter/field in createAccount

03bf98c

Update api/src/main/java/org/apache/cloudstack/api/command/admin/acco…

91a1432

…unt/CreateAccountCmd.java Co-authored-by: GaOrtiga <49285692+GaOrtiga@users.noreply.github.com>

Apply suggestion from @vishesh92

e519bac

disallow empty passwords

340145e

DaanHoogland force-pushed the ghi12039-optional-password-for-saml-account branch from c5f8b6a to 340145e Compare November 9, 2026 12:12

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Copilot stopped reviewing on behalf of DaanHoogland due to an error November 9, 2026 12:33
The job was not acquired by a runner even after multiple attempts.

make null-password test not depend on the internal-error path

3d41b2c

Copilot AI lite review requested due to automatic review settings November 9, 2026 14:45

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Copilot stopped reviewing on behalf of DaanHoogland due to an error November 9, 2026 15:23
The job was not acquired by a runner even after multiple attempts.

nvazquez approved these changes Nov 10, 2026

View reviewed changes

Comment thread api/src/main/java/org/apache/cloudstack/api/command/admin/account/CreateAccountCmd.java Resolved

Remove extra space

8a5cbc5

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI lite review requested due to automatic review settings November 10, 2026 10:12

Copilot AI reviewed Nov 10, 2026

View reviewed changes

space after punctuation

e034acf

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI lite review requested due to automatic review settings November 10, 2026 10:38

DaanHoogland commented Nov 10, 2026

View reviewed changes

Comment thread ui/src/views/iam/AddAccount.vue Resolved

Apply suggestion from @DaanHoogland

3b3010f

Copilot AI reviewed Nov 10, 2026

View reviewed changes

Copilot AI lite review requested due to automatic review settings November 10, 2026 10:55

Copilot AI reviewed Nov 10, 2026

View reviewed changes

Copilot stopped reviewing on behalf of DaanHoogland due to an error November 10, 2026 12:09
The job was not acquired by a runner even after multiple attempts.

Copilot stopped reviewing on behalf of DaanHoogland due to an error November 10, 2026 12:14
Workflow completed but conclusion is not available. This may indicate rate limiting or API issues.

Copilot stopped reviewing on behalf of DaanHoogland due to an error November 10, 2026 12:16
The job was not acquired by a runner even after multiple attempts.

		Assert.assertEquals("a password should be generated for accounts that authenticate externally",
		12, createAccountCmd.getPassword().length());

		description = "Clear text password (Default hashed to SHA256SALT). If you wish to use any other hashing algorithm, you will need to write a custom authentication adapter. See Docs section."
		+ " If omitted, a random password is generated, e.g. for an account that will only ever authenticate externally via SAML/LDAP.")

Conversation

DaanHoogland commented Aug 22, 2026

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

codecov Bot commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔴 Test Coverage Grade: D — Marginal

Grade Scale

Uh oh!

GaOrtiga left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

DaanHoogland commented Aug 25, 2026

Uh oh!

blueorangutan commented Aug 25, 2026

Uh oh!

blueorangutan commented Aug 25, 2026

Uh oh!

DaanHoogland commented Aug 26, 2026

Uh oh!

DaanHoogland commented Aug 26, 2026

Uh oh!

Uh oh!

vishesh92 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Sep 9, 2026

Quality Gate passed

Uh oh!

blueorangutan commented Sep 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

nvazquez commented Nov 10, 2026

Uh oh!

nvazquez left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

DaanHoogland commented Nov 10, 2026

Uh oh!

blueorangutan commented Nov 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

codecov Bot commented Aug 22, 2026 •

edited

Loading

github-actions Bot commented Aug 22, 2026 •

edited

Loading

🔴 Test Coverage Grade: `D` — Marginal