Index: lams_central/src/java/org/lamsfoundation/lams/web/shibboleth/ShibLoginServlet.java
===================================================================
RCS file: /usr/local/cvsroot/lams_central/src/java/org/lamsfoundation/lams/web/shibboleth/Attic/ShibLoginServlet.java,v
diff -u -r1.1.2.1 -r1.1.2.2
--- lams_central/src/java/org/lamsfoundation/lams/web/shibboleth/ShibLoginServlet.java	27 Aug 2007 05:46:08 -0000	1.1.2.1
+++ lams_central/src/java/org/lamsfoundation/lams/web/shibboleth/ShibLoginServlet.java	31 Oct 2007 05:26:09 -0000	1.1.2.2
@@ -34,6 +34,7 @@
 import org.apache.log4j.Logger;
 import org.lamsfoundation.lams.federation.FederationException;
 import org.lamsfoundation.lams.federation.service.IFederationService;
+import org.lamsfoundation.lams.integration.security.RandomPasswordGenerator;
 import org.lamsfoundation.lams.usermanagement.AuthenticationMethod;
 import org.lamsfoundation.lams.usermanagement.Organisation;
 import org.lamsfoundation.lams.usermanagement.OrganisationState;
@@ -111,11 +112,6 @@
 			if (user != null) {
 				// TODO update user attributes if changed
 				log.info("Found account for shibboleth user "+localUsername+"...");
-				// no need to keep track of local users' roles
-				if (localUsername.equals(username)) {
-					response.sendRedirect("j_security_check?j_username="+localUsername+"&j_password="+user.getPassword());
-					return;
-				}
 			} else {
 				try {
 					log.info("Creating new user: "+localUsername);
@@ -137,7 +133,7 @@
 				log.error("Couldn't update "+localUsername+"'s roles.", e);
 			}
 			
-			response.sendRedirect("j_security_check?j_username="+localUsername+"&j_password="+MAGIC_PASSWD);
+			response.sendRedirect("j_security_check?j_username="+localUsername+"&j_password="+user.getPassword());
 		} else {
 			// somehow lost shib username attribute, send back to login page
 			log.error("Couldn't get a username from shibboleth header: "+Configuration.get(ConfigurationKeys.SHIB_ATTR_LOGIN));
@@ -167,7 +163,7 @@
 	private User saveNewUser(String username, String fname, String lname, String email) {
 		User user = new User();
 		user.setLogin(username);
-		user.setPassword(MAGIC_PASSWD);
+		user.setPassword(RandomPasswordGenerator.nextPassword(10));
 		if (fname != null && fname.trim().length()>0) {
 			user.setFirstName(fname);
 		} else {