[ACS-11076] Disable password grant flow (#3860)

Co-authored-by: Kacper Magdziarz <95610011+kmagdziarz@users.noreply.github.com>

repository/src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceFacade.java

@@ -172,6 +172,7 @@ public interface IdentityServiceFacade
         private final String refreshToken;
         private final String authorizationCode;
         private final String redirectUri;
+        private static boolean passwordGrantEnabled;
 
         private AuthorizationGrant(String username, String password, String refreshToken, String authorizationCode, String redirectUri)
         {
@@ -197,8 +198,17 @@ public interface IdentityServiceFacade
             return new AuthorizationGrant(null, null, null, requireNonNull(authorizationCode), requireNonNull(redirectUri));
         }
 
+        public static void setPasswordGrantEnabled(boolean passwordGrantEnabled)
+        {
+            AuthorizationGrant.passwordGrantEnabled = passwordGrantEnabled;
+        }
+
         boolean isPassword()
         {
+            if (nonNull(username) && !passwordGrantEnabled)
+            {
+                throw new AuthorizationException("Resource Owner Password Flow is deprecated and disabled. Obtain a Bearer access token from the identity service and retry the request.");
+            }
             return nonNull(username);
         }
 

repository/src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceFacadeFactoryBean.java

@@ -147,6 +147,11 @@ public class IdentityServiceFacadeFactoryBean implements FactoryBean<IdentitySer
         this.enabled = enabled;
     }
 
+    public void setPasswordGrantEnabled(boolean passwordGrantEnabled)
+    {
+        IdentityServiceFacade.AuthorizationGrant.setPasswordGrantEnabled(passwordGrantEnabled);
+    }
+
     public void setIdentityServiceConfig(IdentityServiceConfig identityServiceConfig)
     {
         factory = new SpringBasedIdentityServiceFacadeFactory(

repository/src/main/resources/alfresco/subsystems/Authentication/identity-service/identity-service-authentication-context.xml

@@ -34,6 +34,9 @@
          <ref bean="identityServiceConfig" />
       </property>
       <property name="enabled">
+         <value>${identity-service.authentication.enabled}</value>
+      </property>
+      <property name="passwordGrantEnabled">
          <value>${identity-service.authentication.enable-username-password-authentication:false}</value>
       </property>
    </bean>

repository/src/main/resources/alfresco/subsystems/Authentication/identity-service/identity-service-authentication.properties

@@ -3,7 +3,7 @@ identity-service.authentication.validation.failure.silent=true
 identity-service.authentication.defaultAdministratorUserNames=admin
 identity-service.authentication.allowGuestLogin=true
 # The Identity Service client required to perform username/password authentication will not be created if false
-identity-service.authentication.enable-username-password-authentication=true
+identity-service.authentication.enable-username-password-authentication=false
 
 # Identity Service configuration
 identity-service.auth-server-url=http://localhost:8180/auth