diff --git a/core/src/main/java/org/springframework/security/provisioning/InMemoryUserDetailsManager.java b/core/src/main/java/org/springframework/security/provisioning/InMemoryUserDetailsManager.java index 55c462cde4..7367bc9c02 100644 --- a/core/src/main/java/org/springframework/security/provisioning/InMemoryUserDetailsManager.java +++ b/core/src/main/java/org/springframework/security/provisioning/InMemoryUserDetailsManager.java @@ -143,7 +143,7 @@ public class InMemoryUserDetailsManager implements UserDetailsManager, @Override public UserDetails updatePassword(UserDetails user, String newPassword) { String username = user.getUsername(); - MutableUserDetails mutableUser = this.users.get(username); + MutableUserDetails mutableUser = this.users.get(username.toLowerCase()); mutableUser.setPassword(newPassword); return mutableUser; } diff --git a/core/src/test/java/org/springframework/security/provisioning/InMemoryUserDetailsManagerTests.java b/core/src/test/java/org/springframework/security/provisioning/InMemoryUserDetailsManagerTests.java index 9f58cc5385..41f0560ea0 100644 --- a/core/src/test/java/org/springframework/security/provisioning/InMemoryUserDetailsManagerTests.java +++ b/core/src/test/java/org/springframework/security/provisioning/InMemoryUserDetailsManagerTests.java @@ -18,6 +18,7 @@ package org.springframework.security.provisioning; import org.junit.Test; import org.springframework.security.core.userdetails.PasswordEncodedUser; +import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import static org.assertj.core.api.Assertions.*; @@ -37,4 +38,15 @@ public class InMemoryUserDetailsManagerTests { this.manager.updatePassword(this.user, newPassword); assertThat(this.manager.loadUserByUsername(this.user.getUsername()).getPassword()).isEqualTo(newPassword); } + + @Test + public void changePasswordWhenUsernameIsNotInLowercase() { + UserDetails userNotLowerCase = User.withUserDetails(PasswordEncodedUser.user()) + .username("User") + .build(); + + String newPassword = "newPassword"; + this.manager.updatePassword(userNotLowerCase, newPassword); + assertThat(this.manager.loadUserByUsername(userNotLowerCase.getUsername()).getPassword()).isEqualTo(newPassword); + } }