SONAR-6226 UserUpdater now allows user to be created without password

9 files changed, 105 insertions, 244 deletions

diff --git a/server/sonar-server/src/main/java/org/sonar/server/user/DefaultUserService.java b/server/sonar-server/src/main/java/org/sonar/server/user/DefaultUserService.java
index 519eeb4d75e..9152ebf0e0c 100644
--- a/server/sonar-server/src/main/java/org/sonar/server/user/DefaultUserService.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/user/DefaultUserService.java
@@ -24,6 +24,7 @@ import com.google.common.base.Strings;
 import java.util.List;
 import java.util.Map;
 import javax.annotation.CheckForNull;
+import org.apache.commons.lang.StringUtils;
 import org.sonar.api.user.RubyUserService;
 import org.sonar.api.user.User;
 import org.sonar.api.user.UserFinder;
@@ -34,6 +35,8 @@ import org.sonar.server.user.index.UserDoc;
 import org.sonar.server.user.index.UserIndex;
 import org.sonar.server.util.RubyUtils;
 
+import static org.sonar.server.util.Validation.checkMandatoryParameter;
+
 public class DefaultUserService implements RubyUserService {
 
   private final UserIndex userIndex;
@@ -76,34 +79,23 @@ public class DefaultUserService implements RubyUserService {
   }
 
   public boolean create(Map<String, Object> params) {
+    String password = (String) params.get("password");
+    String passwordConfirmation = (String) params.get("password_confirmation");
+    checkMandatoryParameter(password, "Password");
+    checkMandatoryParameter(passwordConfirmation, "Password confirmation");
+    if (!StringUtils.equals(password, passwordConfirmation)) {
+      throw new BadRequestException("user.password_doesnt_match_confirmation");
+    }
+
     NewUser newUser = NewUser.create()
       .setLogin((String) params.get("login"))
       .setName((String) params.get("name"))
       .setEmail((String) params.get("email"))
       .setScmAccounts(RubyUtils.toStrings(params.get("scm_accounts")))
-      .setPassword((String) params.get("password"))
-      .setPasswordConfirmation((String) params.get("password_confirmation"));
+      .setPassword(password);
     return userUpdater.create(newUser);
   }
 
-  public void update(Map<String, Object> params) {
-    UpdateUser updateUser = UpdateUser.create((String) params.get("login"));
-    if (params.containsKey("name")) {
-      updateUser.setName((String) params.get("name"));
-    }
-    if (params.containsKey("email")) {
-      updateUser.setEmail((String) params.get("email"));
-    }
-    if (params.containsKey("scm_accounts")) {
-      updateUser.setScmAccounts(RubyUtils.toStrings(params.get("scm_accounts")));
-    }
-    if (params.containsKey("password")) {
-      updateUser.setPassword((String) params.get("password"));
-      updateUser.setPasswordConfirmation((String) params.get("password_confirmation"));
-    }
-    userUpdater.update(updateUser);
-  }
-
   public void deactivate(String login) {
     if (Strings.isNullOrEmpty(login)) {
       throw new BadRequestException("Login is missing");
diff --git a/server/sonar-server/src/main/java/org/sonar/server/user/NewUser.java b/server/sonar-server/src/main/java/org/sonar/server/user/NewUser.java
index 43fbb583d67..ea509021993 100644
--- a/server/sonar-server/src/main/java/org/sonar/server/user/NewUser.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/user/NewUser.java
@@ -19,11 +19,10 @@
  */
 package org.sonar.server.user;
 
+import java.util.List;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
 
-import java.util.List;
-
 public class NewUser {
 
   private String login;
@@ -88,16 +87,6 @@ public class NewUser {
     return this;
   }
 
-  @Nullable
-  public String passwordConfirmation() {
-    return passwordConfirmation;
-  }
-
-  public NewUser setPasswordConfirmation(@Nullable String passwordConfirmation) {
-    this.passwordConfirmation = passwordConfirmation;
-    return this;
-  }
-
   public static NewUser create() {
     return new NewUser();
   }
diff --git a/server/sonar-server/src/main/java/org/sonar/server/user/UserUpdater.java b/server/sonar-server/src/main/java/org/sonar/server/user/UserUpdater.java
index 280872eb0e8..b61fe46b76e 100644
--- a/server/sonar-server/src/main/java/org/sonar/server/user/UserUpdater.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/user/UserUpdater.java
@@ -31,7 +31,6 @@ import java.util.Random;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
 import org.apache.commons.codec.digest.DigestUtils;
-import org.apache.commons.lang.StringUtils;
 import org.sonar.api.CoreProperties;
 import org.sonar.api.config.Settings;
 import org.sonar.api.platform.NewUserHandler;
@@ -57,7 +56,6 @@ import static org.sonar.api.CoreProperties.CORE_AUTHENTICATOR_LOCAL_USERS;
 public class UserUpdater {
 
   private static final String LOGIN_PARAM = "Login";
-  private static final String PASSWORD_CONFIRMATION_PARAM = "Password confirmation";
   private static final String PASSWORD_PARAM = "Password";
   private static final String NAME_PARAM = "Name";
   private static final String EMAIL_PARAM = "Email";
@@ -89,37 +87,39 @@ public class UserUpdater {
    * Return true if the user has been reactivated
    */
   public boolean create(NewUser newUser) {
-    boolean isUserReactivated = false;
-
     DbSession dbSession = dbClient.openSession(false);
     try {
-      UserDto userDto = createNewUserDto(dbSession, newUser);
-      String login = userDto.getLogin();
-      UserDto existingUser = dbClient.userDao().selectByLogin(dbSession, login);
-      if (existingUser == null) {
-        saveUser(dbSession, userDto);
-        addDefaultGroup(dbSession, userDto);
-      } else {
-        if (existingUser.isActive()) {
-          throw new IllegalArgumentException(String.format("An active user with login '%s' already exists", login));
-        }
-        UpdateUser updateUser = UpdateUser.create(login)
-          .setName(newUser.name())
-          .setEmail(newUser.email())
-          .setScmAccounts(newUser.scmAccounts())
-          .setPassword(newUser.password())
-          .setPasswordConfirmation(newUser.passwordConfirmation());
-        updateUserDto(dbSession, updateUser, existingUser);
-        updateUser(dbSession, existingUser);
-        addDefaultGroup(dbSession, existingUser);
-        isUserReactivated = true;
-      }
-      dbSession.commit();
-      notifyNewUser(userDto.getLogin(), userDto.getName(), newUser.email());
-      userIndexer.index();
+      return create(dbSession, newUser);
     } finally {
-      dbSession.close();
+      dbClient.closeSession(dbSession);
     }
+  }
+
+  public boolean create(DbSession dbSession, NewUser newUser){
+    boolean isUserReactivated = false;
+    UserDto userDto = createNewUserDto(dbSession, newUser);
+    String login = userDto.getLogin();
+    UserDto existingUser = dbClient.userDao().selectByLogin(dbSession, login);
+    if (existingUser == null) {
+      saveUser(dbSession, userDto);
+      addDefaultGroup(dbSession, userDto);
+    } else {
+      if (existingUser.isActive()) {
+        throw new IllegalArgumentException(String.format("An active user with login '%s' already exists", login));
+      }
+      UpdateUser updateUser = UpdateUser.create(login)
+        .setName(newUser.name())
+        .setEmail(newUser.email())
+        .setScmAccounts(newUser.scmAccounts())
+        .setPassword(newUser.password());
+      updateUserDto(dbSession, updateUser, existingUser);
+      updateUser(dbSession, existingUser);
+      addDefaultGroup(dbSession, existingUser);
+      isUserReactivated = true;
+    }
+    dbSession.commit();
+    notifyNewUser(userDto.getLogin(), userDto.getName(), newUser.email());
+    userIndexer.index();
     return isUserReactivated;
   }
 
@@ -183,9 +183,10 @@ public class UserUpdater {
     }
 
     String password = newUser.password();
-    String passwordConfirmation = newUser.passwordConfirmation();
-    validatePasswords(password, passwordConfirmation, messages);
-    setEncryptedPassWord(password, userDto);
+    if (password != null) {
+      validatePasswords(password, messages);
+      setEncryptedPassWord(password, userDto);
+    }
 
     List<String> scmAccounts = sanitizeScmAccounts(newUser.scmAccounts());
     if (scmAccounts != null && !scmAccounts.isEmpty()) {
@@ -215,10 +216,9 @@ public class UserUpdater {
     }
 
     String password = updateUser.password();
-    String passwordConfirmation = updateUser.passwordConfirmation();
     if (updateUser.isPasswordChanged()) {
       checkPasswordChangeAllowed(updateUser.login(), messages);
-      validatePasswords(password, passwordConfirmation, messages);
+      validatePasswords(password, messages);
       setEncryptedPassWord(password, userDto);
     }
 
@@ -275,12 +275,8 @@ public class UserUpdater {
     }
   }
 
-  private static void validatePasswords(@Nullable String password, @Nullable String passwordConfirmation, List<Message> messages) {
+  private static void validatePasswords(@Nullable String password, List<Message> messages) {
     checkNotEmptyParam(password, PASSWORD_PARAM, messages);
-    checkNotEmptyParam(passwordConfirmation, PASSWORD_CONFIRMATION_PARAM, messages);
-    if (!StringUtils.equals(password, passwordConfirmation)) {
-      messages.add(Message.of("user.password_doesnt_match_confirmation"));
-    }
   }
 
   private void validateScmAccounts(DbSession dbSession, List<String> scmAccounts, @Nullable String login, @Nullable String email, @Nullable UserDto existingUser,
diff --git a/server/sonar-server/src/main/java/org/sonar/server/user/ws/ChangePasswordAction.java b/server/sonar-server/src/main/java/org/sonar/server/user/ws/ChangePasswordAction.java
index 941cd604462..4404180a554 100644
--- a/server/sonar-server/src/main/java/org/sonar/server/user/ws/ChangePasswordAction.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/user/ws/ChangePasswordAction.java
@@ -80,9 +80,7 @@ public class ChangePasswordAction implements UsersWsAction {
     }
 
     String password = request.mandatoryParam(PARAM_PASSWORD);
-    UpdateUser updateUser = UpdateUser.create(login)
-      .setPassword(password)
-      .setPasswordConfirmation(password);
+    UpdateUser updateUser = UpdateUser.create(login).setPassword(password);
 
     userUpdater.update(updateUser);
     response.noContent();
diff --git a/server/sonar-server/src/main/java/org/sonar/server/user/ws/CreateAction.java b/server/sonar-server/src/main/java/org/sonar/server/user/ws/CreateAction.java
index 92fcd7650ac..8fa1cd31447 100644
--- a/server/sonar-server/src/main/java/org/sonar/server/user/ws/CreateAction.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/user/ws/CreateAction.java
@@ -100,8 +100,7 @@ public class CreateAction implements UsersWsAction {
       .setName(request.mandatoryParam(PARAM_NAME))
       .setEmail(request.param(PARAM_EMAIL))
       .setScmAccounts(request.paramAsStrings(PARAM_SCM_ACCOUNTS))
-      .setPassword(password)
-      .setPasswordConfirmation(password);
+      .setPassword(password);
 
     boolean isUserReactivated = userUpdater.create(newUser);
     writeResponse(response, login, isUserReactivated);
diff --git a/server/sonar-server/src/test/java/org/sonar/server/issue/IssueServiceMediumTest.java b/server/sonar-server/src/test/java/org/sonar/server/issue/IssueServiceMediumTest.java
index e0454468cb5..b0c47aa7ea0 100644
--- a/server/sonar-server/src/test/java/org/sonar/server/issue/IssueServiceMediumTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/issue/IssueServiceMediumTest.java
@@ -620,7 +620,7 @@ public class IssueServiceMediumTest {
   }
 
   private void newUser(String login) {
-    tester.get(UserUpdater.class).create(NewUser.create().setLogin(login).setName(login).setPassword("test").setPasswordConfirmation("test"));
+    tester.get(UserUpdater.class).create(NewUser.create().setLogin(login).setName(login).setPassword("test"));
   }
 
   private void createDefaultGroup() {
diff --git a/server/sonar-server/src/test/java/org/sonar/server/user/DefaultUserServiceTest.java b/server/sonar-server/src/test/java/org/sonar/server/user/DefaultUserServiceTest.java
index e68962ad395..d6bc5ebdeba 100644
--- a/server/sonar-server/src/test/java/org/sonar/server/user/DefaultUserServiceTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/user/DefaultUserServiceTest.java
@@ -25,17 +25,17 @@ import java.util.Map;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.ExpectedException;
-import org.junit.runner.RunWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.ArgumentMatcher;
-import org.mockito.runners.MockitoJUnitRunner;
 import org.sonar.api.user.UserFinder;
 import org.sonar.api.user.UserQuery;
 import org.sonar.core.permission.GlobalPermissions;
 import org.sonar.server.exceptions.BadRequestException;
 import org.sonar.server.exceptions.ForbiddenException;
+import org.sonar.server.exceptions.Message;
 import org.sonar.server.tester.UserSessionRule;
 import org.sonar.server.user.index.UserIndex;
+import org.sonar.server.util.Validation;
 
 import static com.google.common.collect.Lists.newArrayList;
 import static com.google.common.collect.Maps.newHashMap;
@@ -47,7 +47,6 @@ import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 
-@RunWith(MockitoJUnitRunner.class)
 public class DefaultUserServiceTest {
   @Rule
   public UserSessionRule userSessionRule = UserSessionRule.standalone();
@@ -66,7 +65,7 @@ public class DefaultUserServiceTest {
       "logins", "simon,loic",
       "includeDeactivated", "true",
       "s", "sim"
-      ));
+    ));
 
     verify(finder, times(1)).find(argThat(new ArgumentMatcher<UserQuery>() {
       @Override
@@ -134,11 +133,13 @@ public class DefaultUserServiceTest {
   }
 
   @Test
-  public void create() {
+  public void create_user() {
     Map<String, Object> params = newHashMap();
     params.put("login", "john");
     params.put("name", "John");
     params.put("email", "john@email.com");
+    params.put("password", "123456");
+    params.put("password_confirmation", "123456");
     params.put("scm_accounts", newArrayList("jn"));
     service.create(params);
 
@@ -147,90 +148,56 @@ public class DefaultUserServiceTest {
     assertThat(newUserCaptor.getValue().login()).isEqualTo("john");
     assertThat(newUserCaptor.getValue().name()).isEqualTo("John");
     assertThat(newUserCaptor.getValue().email()).isEqualTo("john@email.com");
+    assertThat(newUserCaptor.getValue().password()).isEqualTo("123456");
     assertThat(newUserCaptor.getValue().scmAccounts()).containsOnly("jn");
   }
 
   @Test
-  public void update() {
+  public void fail_to_create_user_when_password_is_empty() throws Exception {
     Map<String, Object> params = newHashMap();
     params.put("login", "john");
     params.put("name", "John");
     params.put("email", "john@email.com");
-    params.put("scm_accounts", newArrayList("jn"));
-    params.put("password", "1234");
-    params.put("password_confirmation", "1234");
-
-    service.update(params);
-
-    ArgumentCaptor<UpdateUser> userCaptor = ArgumentCaptor.forClass(UpdateUser.class);
-    verify(userUpdater).update(userCaptor.capture());
-    assertThat(userCaptor.getValue().login()).isEqualTo("john");
-    assertThat(userCaptor.getValue().name()).isEqualTo("John");
-    assertThat(userCaptor.getValue().email()).isEqualTo("john@email.com");
-    assertThat(userCaptor.getValue().scmAccounts()).containsOnly("jn");
-    assertThat(userCaptor.getValue().password()).isEqualTo("1234");
-    assertThat(userCaptor.getValue().passwordConfirmation()).isEqualTo("1234");
-  }
+    params.put("password", "");
+    params.put("password_confirmation", "123456");
 
-  @Test
-  public void update_only_name() {
-    Map<String, Object> params = newHashMap();
-    params.put("login", "john");
-    params.put("name", "John");
-    service.update(params);
-
-    ArgumentCaptor<UpdateUser> userCaptor = ArgumentCaptor.forClass(UpdateUser.class);
-    verify(userUpdater).update(userCaptor.capture());
-    assertThat(userCaptor.getValue().isNameChanged()).isTrue();
-    assertThat(userCaptor.getValue().isEmailChanged()).isFalse();
-    assertThat(userCaptor.getValue().isScmAccountsChanged()).isFalse();
-    assertThat(userCaptor.getValue().isPasswordChanged()).isFalse();
+    try {
+      service.create(params);
+    } catch (BadRequestException e) {
+      assertThat(e.errors().messages()).containsOnly(Message.of(Validation.CANT_BE_EMPTY_MESSAGE, "Password"));
+    }
   }
 
   @Test
-  public void update_only_email() {
+  public void fail_to_create_user_when_password_confirmation_is_empty() throws Exception {
     Map<String, Object> params = newHashMap();
     params.put("login", "john");
+    params.put("name", "John");
     params.put("email", "john@email.com");
-    service.update(params);
-
-    ArgumentCaptor<UpdateUser> userCaptor = ArgumentCaptor.forClass(UpdateUser.class);
-    verify(userUpdater).update(userCaptor.capture());
-    assertThat(userCaptor.getValue().isNameChanged()).isFalse();
-    assertThat(userCaptor.getValue().isEmailChanged()).isTrue();
-    assertThat(userCaptor.getValue().isScmAccountsChanged()).isFalse();
-    assertThat(userCaptor.getValue().isPasswordChanged()).isFalse();
-  }
+    params.put("password", "123456");
+    params.put("password_confirmation", "");
 
-  @Test
-  public void update_only_scm_accounts() {
-    Map<String, Object> params = newHashMap();
-    params.put("login", "john");
-    params.put("scm_accounts", newArrayList("jn"));
-    service.update(params);
-
-    ArgumentCaptor<UpdateUser> userCaptor = ArgumentCaptor.forClass(UpdateUser.class);
-    verify(userUpdater).update(userCaptor.capture());
-    assertThat(userCaptor.getValue().isNameChanged()).isFalse();
-    assertThat(userCaptor.getValue().isEmailChanged()).isFalse();
-    assertThat(userCaptor.getValue().isScmAccountsChanged()).isTrue();
-    assertThat(userCaptor.getValue().isPasswordChanged()).isFalse();
+    try {
+      service.create(params);
+    } catch (BadRequestException e) {
+      assertThat(e.errors().messages()).containsOnly(Message.of(Validation.CANT_BE_EMPTY_MESSAGE, "Password confirmation"));
+    }
   }
 
   @Test
-  public void update_only_password() {
+  public void fail_to_create_user_when_password_does_not_match_confirmation() throws Exception {
     Map<String, Object> params = newHashMap();
     params.put("login", "john");
-    params.put("password", "1234");
-    params.put("password_confirmation", "1234");
-    service.update(params);
-
-    ArgumentCaptor<UpdateUser> userCaptor = ArgumentCaptor.forClass(UpdateUser.class);
-    verify(userUpdater).update(userCaptor.capture());
-    assertThat(userCaptor.getValue().isNameChanged()).isFalse();
-    assertThat(userCaptor.getValue().isEmailChanged()).isFalse();
-    assertThat(userCaptor.getValue().isScmAccountsChanged()).isFalse();
-    assertThat(userCaptor.getValue().isPasswordChanged()).isTrue();
+    params.put("name", "John");
+    params.put("email", "john@email.com");
+    params.put("password", "123456");
+    params.put("password_confirmation", "654321");
+
+    try {
+      service.create(params);
+    } catch (BadRequestException e) {
+      assertThat(e.errors().messages()).containsOnly(Message.of("user.password_doesnt_match_confirmation"));
+    }
   }
 
   @Test
diff --git a/server/sonar-server/src/test/java/org/sonar/server/user/UserUpdaterTest.java b/server/sonar-server/src/test/java/org/sonar/server/user/UserUpdaterTest.java
index 7d6b3439226..c7da098ca41 100644
--- a/server/sonar-server/src/test/java/org/sonar/server/user/UserUpdaterTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/user/UserUpdaterTest.java
@@ -115,7 +115,6 @@ public class UserUpdaterTest {
       .setName("User")
       .setEmail("user@mail.com")
       .setPassword("password")
-      .setPasswordConfirmation("password")
       .setScmAccounts(newArrayList("u1", "u_1", "User 1")));
 
     UserDto dto = userDao.selectByLogin(session, "user");
@@ -148,9 +147,7 @@ public class UserUpdaterTest {
 
     userUpdater.create(NewUser.create()
       .setLogin("user")
-      .setName("User")
-      .setPassword("password")
-      .setPasswordConfirmation("password"));
+      .setName("User"));
 
     UserDto dto = userDao.selectByLogin(session, "user");
     assertThat(dto.getId()).isNotNull();
@@ -170,7 +167,6 @@ public class UserUpdaterTest {
       .setLogin("user")
       .setName("User")
       .setPassword("password")
-      .setPasswordConfirmation("password")
       .setScmAccounts(newArrayList("u1", "", null)));
 
     assertThat(userDao.selectByLogin(session, "user").getScmAccountsAsList()).containsOnly("u1");
@@ -185,7 +181,6 @@ public class UserUpdaterTest {
       .setLogin("user")
       .setName("User")
       .setPassword("password")
-      .setPasswordConfirmation("password")
       .setScmAccounts(newArrayList("")));
 
     assertThat(userDao.selectByLogin(session, "user").getScmAccounts()).isNull();
@@ -200,7 +195,6 @@ public class UserUpdaterTest {
       .setLogin("user")
       .setName("User")
       .setPassword("password")
-      .setPasswordConfirmation("password")
       .setScmAccounts(newArrayList("u1", "u1")));
 
     assertThat(userDao.selectByLogin(session, "user").getScmAccountsAsList()).containsOnly("u1");
@@ -213,8 +207,7 @@ public class UserUpdaterTest {
         .setLogin(null)
         .setName("Marius")
         .setEmail("marius@mail.com")
-        .setPassword("password")
-        .setPasswordConfirmation("password"));
+        .setPassword("password"));
       fail();
     } catch (BadRequestException e) {
       assertThat(e.errors().messages()).containsOnly(Message.of(Validation.CANT_BE_EMPTY_MESSAGE, "Login"));
@@ -228,8 +221,7 @@ public class UserUpdaterTest {
         .setLogin("/marius/")
         .setName("Marius")
         .setEmail("marius@mail.com")
-        .setPassword("password")
-        .setPasswordConfirmation("password"));
+        .setPassword("password"));
       fail();
     } catch (BadRequestException e) {
       assertThat(e.errors().messages()).containsOnly(Message.of("user.bad_login"));
@@ -243,8 +235,7 @@ public class UserUpdaterTest {
         .setLogin("ma")
         .setName("Marius")
         .setEmail("marius@mail.com")
-        .setPassword("password")
-        .setPasswordConfirmation("password"));
+        .setPassword("password"));
       fail();
     } catch (BadRequestException e) {
       assertThat(e.errors().messages()).containsOnly(Message.of(Validation.IS_TOO_SHORT_MESSAGE, "Login", 3));
@@ -258,8 +249,7 @@ public class UserUpdaterTest {
         .setLogin(Strings.repeat("m", 256))
         .setName("Marius")
         .setEmail("marius@mail.com")
-        .setPassword("password")
-        .setPasswordConfirmation("password"));
+        .setPassword("password"));
       fail();
     } catch (BadRequestException e) {
       assertThat(e.errors().messages()).containsOnly(Message.of(Validation.IS_TOO_LONG_MESSAGE, "Login", 255));
@@ -273,8 +263,7 @@ public class UserUpdaterTest {
         .setLogin(DEFAULT_LOGIN)
         .setName(null)
         .setEmail("marius@mail.com")
-        .setPassword("password")
-        .setPasswordConfirmation("password"));
+        .setPassword("password"));
       fail();
     } catch (BadRequestException e) {
       assertThat(e.errors().messages()).containsOnly(Message.of(Validation.CANT_BE_EMPTY_MESSAGE, "Name"));
@@ -288,8 +277,7 @@ public class UserUpdaterTest {
         .setLogin(DEFAULT_LOGIN)
         .setName(Strings.repeat("m", 201))
         .setEmail("marius@mail.com")
-        .setPassword("password")
-        .setPasswordConfirmation("password"));
+        .setPassword("password"));
       fail();
     } catch (BadRequestException e) {
       assertThat(e.errors().messages()).containsOnly(Message.of(Validation.IS_TOO_LONG_MESSAGE, "Name", 200));
@@ -303,8 +291,7 @@ public class UserUpdaterTest {
         .setLogin(DEFAULT_LOGIN)
         .setName("Marius")
         .setEmail(Strings.repeat("m", 101))
-        .setPassword("password")
-        .setPasswordConfirmation("password"));
+        .setPassword("password"));
       fail();
     } catch (BadRequestException e) {
       assertThat(e.errors().messages()).containsOnly(Message.of(Validation.IS_TOO_LONG_MESSAGE, "Email", 100));
@@ -312,62 +299,16 @@ public class UserUpdaterTest {
   }
 
   @Test
-  public void fail_to_create_user_with_missing_password() {
-    try {
-      userUpdater.create(NewUser.create()
-        .setLogin(DEFAULT_LOGIN)
-        .setName("Marius")
-        .setEmail("marius@mail.com")
-        .setPassword(null)
-        .setPasswordConfirmation("password"));
-      fail();
-    } catch (BadRequestException e) {
-      assertThat(e.errors().messages()).contains(Message.of(Validation.CANT_BE_EMPTY_MESSAGE, "Password"));
-    }
-  }
-
-  @Test
-  public void fail_to_create_user_with_missing_password_confirmation() {
-    try {
-      userUpdater.create(NewUser.create()
-        .setLogin(DEFAULT_LOGIN)
-        .setName("Marius")
-        .setEmail("marius@mail.com")
-        .setPassword("password")
-        .setPasswordConfirmation(null));
-      fail();
-    } catch (BadRequestException e) {
-      assertThat(e.errors().messages()).contains(Message.of(Validation.CANT_BE_EMPTY_MESSAGE, "Password confirmation"));
-    }
-  }
-
-  @Test
-  public void fail_to_create_user_with_password_not_matching_password_confirmation() {
-    try {
-      userUpdater.create(NewUser.create()
-        .setLogin(DEFAULT_LOGIN)
-        .setName("Marius")
-        .setEmail("marius@mail.com")
-        .setPassword("password")
-        .setPasswordConfirmation("password2"));
-      fail();
-    } catch (BadRequestException e) {
-      assertThat(e.errors().messages()).containsOnly(Message.of("user.password_doesnt_match_confirmation"));
-    }
-  }
-
-  @Test
   public void fail_to_create_user_with_many_errors() {
     try {
       userUpdater.create(NewUser.create()
         .setLogin("")
         .setName("")
         .setEmail("marius@mail.com")
-        .setPassword("")
-        .setPasswordConfirmation(""));
+        .setPassword(""));
       fail();
     } catch (BadRequestException e) {
-      assertThat(e.errors().messages()).hasSize(4);
+      assertThat(e.errors().messages()).hasSize(3);
     }
   }
 
@@ -381,7 +322,6 @@ public class UserUpdaterTest {
         .setName("Marius")
         .setEmail("marius@mail.com")
         .setPassword("password")
-        .setPasswordConfirmation("password")
         .setScmAccounts(newArrayList("jo")));
       fail();
     } catch (BadRequestException e) {
@@ -399,7 +339,6 @@ public class UserUpdaterTest {
         .setName("Marius")
         .setEmail("marius@mail.com")
         .setPassword("password")
-        .setPasswordConfirmation("password")
         .setScmAccounts(newArrayList("john@email.com")));
       fail();
     } catch (BadRequestException e) {
@@ -415,7 +354,6 @@ public class UserUpdaterTest {
         .setName("Marius2")
         .setEmail("marius2@mail.com")
         .setPassword("password2")
-        .setPasswordConfirmation("password2")
         .setScmAccounts(newArrayList(DEFAULT_LOGIN)));
       fail();
     } catch (BadRequestException e) {
@@ -431,7 +369,6 @@ public class UserUpdaterTest {
         .setName("Marius2")
         .setEmail("marius2@mail.com")
         .setPassword("password2")
-        .setPasswordConfirmation("password2")
         .setScmAccounts(newArrayList("marius2@mail.com")));
       fail();
     } catch (BadRequestException e) {
@@ -448,7 +385,6 @@ public class UserUpdaterTest {
       .setName("User")
       .setEmail("user@mail.com")
       .setPassword("password")
-      .setPasswordConfirmation("password")
       .setScmAccounts(newArrayList("u1", "u_1")));
 
     verify(newUserNotifier).onNewUser(newUserHandler.capture());
@@ -466,7 +402,6 @@ public class UserUpdaterTest {
       .setName("User")
       .setEmail("user@mail.com")
       .setPassword("password")
-      .setPasswordConfirmation("password")
       .setScmAccounts(newArrayList("u1", "u_1")));
 
     GroupMembershipFinder.Membership membership = groupMembershipFinder.find(GroupMembershipQuery.builder().login("user").build());
@@ -485,7 +420,6 @@ public class UserUpdaterTest {
         .setName("User")
         .setEmail("user@mail.com")
         .setPassword("password")
-        .setPasswordConfirmation("password")
         .setScmAccounts(newArrayList("u1", "u_1")));
     } catch (Exception e) {
       assertThat(e).isInstanceOf(ServerException.class).hasMessage("The default group property 'sonar.defaultGroup' is null");
@@ -502,7 +436,6 @@ public class UserUpdaterTest {
         .setName("User")
         .setEmail("user@mail.com")
         .setPassword("password")
-        .setPasswordConfirmation("password")
         .setScmAccounts(newArrayList("u1", "u_1")));
     } catch (Exception e) {
       assertThat(e).isInstanceOf(ServerException.class)
@@ -520,8 +453,7 @@ public class UserUpdaterTest {
       .setLogin(DEFAULT_LOGIN)
       .setName("Marius2")
       .setEmail("marius2@mail.com")
-      .setPassword("password2")
-      .setPasswordConfirmation("password2"));
+      .setPassword("password2"));
     session.commit();
 
     UserDto dto = userDao.selectByLogin(session, DEFAULT_LOGIN);
@@ -548,8 +480,7 @@ public class UserUpdaterTest {
         .setLogin(DEFAULT_LOGIN)
         .setName("Marius2")
         .setEmail("marius2@mail.com")
-        .setPassword("password2")
-        .setPasswordConfirmation("password2"));
+        .setPassword("password2"));
       fail();
     } catch (Exception e) {
       assertThat(e).isInstanceOf(IllegalArgumentException.class).hasMessage("An active user with login 'marius' already exists");
@@ -565,8 +496,7 @@ public class UserUpdaterTest {
       .setLogin(DEFAULT_LOGIN)
       .setName("Marius2")
       .setEmail("marius2@mail.com")
-      .setPassword("password2")
-      .setPasswordConfirmation("password2"));
+      .setPassword("password2"));
     session.commit();
 
     GroupMembershipFinder.Membership membership = groupMembershipFinder.find(GroupMembershipQuery.builder().login(DEFAULT_LOGIN).groupSearch("sonar-users").build());
@@ -585,7 +515,6 @@ public class UserUpdaterTest {
       .setName("Marius2")
       .setEmail("marius2@mail.com")
       .setPassword("password2")
-      .setPasswordConfirmation("password2")
       .setScmAccounts(newArrayList("ma2")));
     session.commit();
     session.clearCache();
@@ -620,7 +549,6 @@ public class UserUpdaterTest {
       .setName("Marius2")
       .setEmail("marius2@mail.com")
       .setPassword("password2")
-      .setPasswordConfirmation("password2")
       .setScmAccounts(newArrayList("ma2")));
     session.commit();
     session.clearCache();
@@ -654,7 +582,6 @@ public class UserUpdaterTest {
       .setName("Marius2")
       .setEmail("marius2@mail.com")
       .setPassword("password2")
-      .setPasswordConfirmation("password2")
       .setScmAccounts(newArrayList("ma2", "", null)));
     session.commit();
     session.clearCache();
@@ -757,8 +684,7 @@ public class UserUpdaterTest {
     createDefaultGroup();
 
     userUpdater.update(UpdateUser.create(DEFAULT_LOGIN)
-      .setPassword("password2")
-      .setPasswordConfirmation("password2"));
+      .setPassword("password2"));
     session.commit();
     session.clearCache();
 
@@ -780,8 +706,7 @@ public class UserUpdaterTest {
 
     try {
       userUpdater.update(UpdateUser.create(DEFAULT_LOGIN)
-        .setPassword("password2")
-        .setPasswordConfirmation("password2"));
+        .setPassword("password2"));
     } catch (BadRequestException e) {
       assertThat(e.errors().messages()).containsOnly(Message.of("user.password_cant_be_changed_on_external_auth"));
     }
@@ -794,8 +719,7 @@ public class UserUpdaterTest {
     when(realmFactory.hasExternalAuthentication()).thenReturn(true);
 
     userUpdater.update(UpdateUser.create(TECHNICAL_USER)
-      .setPassword("password2")
-      .setPasswordConfirmation("password2"));
+      .setPassword("password2"));
 
     UserDto dto = userDao.selectByLogin(session, TECHNICAL_USER);
     assertThat(dto.getSalt()).isNotEqualTo("79bd6a8e79fb8c76ac8b121cc7e8e11ad1af8365");
@@ -811,7 +735,6 @@ public class UserUpdaterTest {
       .setName("Marius2")
       .setEmail("marius2@mail.com")
       .setPassword("password2")
-      .setPasswordConfirmation("password2")
       .setScmAccounts(newArrayList("ma2")));
     session.commit();
 
@@ -837,7 +760,6 @@ public class UserUpdaterTest {
       .setName("Marius2")
       .setEmail("marius2@mail.com")
       .setPassword("password2")
-      .setPasswordConfirmation("password2")
       .setScmAccounts(newArrayList("ma2")));
     session.commit();
 
@@ -858,7 +780,6 @@ public class UserUpdaterTest {
         .setName("Marius2")
         .setEmail("marius2@mail.com")
         .setPassword("password2")
-        .setPasswordConfirmation("password2")
         .setScmAccounts(newArrayList("jo")));
       fail();
     } catch (BadRequestException e) {
diff --git a/server/sonar-server/src/test/java/org/sonar/server/user/ws/ChangePasswordActionTest.java b/server/sonar-server/src/test/java/org/sonar/server/user/ws/ChangePasswordActionTest.java
index 8bdd26c1e90..fbf8f28a878 100644
--- a/server/sonar-server/src/test/java/org/sonar/server/user/ws/ChangePasswordActionTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/user/ws/ChangePasswordActionTest.java
@@ -30,7 +30,9 @@ import org.sonar.api.utils.System2;
 import org.sonar.core.permission.GlobalPermissions;
 import org.sonar.db.DbSession;
 import org.sonar.db.DbTester;
+import org.sonar.db.user.GroupDao;
 import org.sonar.db.user.GroupDto;
+import org.sonar.db.user.UserDao;
 import org.sonar.db.user.UserGroupDao;
 import org.sonar.server.db.DbClient;
 import org.sonar.server.es.EsTester;
@@ -42,8 +44,6 @@ import org.sonar.server.user.NewUser;
 import org.sonar.server.user.NewUserNotifier;
 import org.sonar.server.user.SecurityRealmFactory;
 import org.sonar.server.user.UserUpdater;
-import org.sonar.db.user.GroupDao;
-import org.sonar.db.user.UserDao;
 import org.sonar.server.user.index.UserIndex;
 import org.sonar.server.user.index.UserIndexDefinition;
 import org.sonar.server.user.index.UserIndexer;
@@ -206,7 +206,6 @@ public class ChangePasswordActionTest {
       .setLogin("john")
       .setName("John")
       .setScmAccounts(newArrayList("jn"))
-      .setPassword("Valar Dohaeris")
-      .setPasswordConfirmation("Valar Dohaeris"));
+      .setPassword("Valar Dohaeris"));
   }
 }