Tokens without password should not trigger changed password invalidation

[juliusknorr]

Before this app passwords that were generated through a login method that doesn't provide a password (e.g. when using an oidc id token as bearer auth header) did invalidate themselves on the first use (after the 5 minute offset for token checking).

Steps to reproduce:

• Setup user_oidc and enable bearer token validation for oidc tokens
• Request an app password through curl -X GET "https://nextcloud.local/ocs/v1.php/core/getapppassword" -H "OCS-APIRequest: true" -H "Accept: application/json" -H "Authorization: Bearer OIDC_ID_TOKEN"
• Wait for 5 minutes
• Request any endpoint with the app password
• Any follow up request would fail before as markPasswordInvalid gets called for the app password

This is similar to #27886 but gets only triggered when using an IApacheBackend where an empty string is set in

server/lib/private/legacy/OC_User.php

Line 193 in 57a816a

'password' => '',

. This will then lead to a token being generated with an empty string as password instead of a password which should not trigger a comparison with the real password when either SAML with LDAP as a user backend or a passwordless user backend like oidc is used.

[PVince81]

Makes sense 👍

[juliusknorr]

/backport to stable22

[juliusknorr]

/backport to stable21

[MichaIng]

/backport to stable20