  public User updateUser(JpaUser user) throws NotFoundException, UnauthorizedException {
    if (!UserDirectoryUtils.isCurrentUserAuthorizedHandleRoles(securityService, user.getRoles()))
      throw new UnauthorizedException("The user is not allowed to set the admin role on other users");

    JpaUser updateUser = UserDirectoryPersistenceUtil.findUser(user.getUsername(), user.getOrganization().getId(), emf);
    if (updateUser == null) {
      throw new NotFoundException("User " + user.getUsername() + " not found.");
    }

    logger.debug("updateUser({})", user.getUsername());

    if (!UserDirectoryUtils.isCurrentUserAuthorizedHandleRoles(securityService, updateUser.getRoles()))
      throw new UnauthorizedException("The user is not allowed to update an admin user");

    String encodedPassword;
    //only update Password if a value is set
    if (StringUtils.isEmpty(user.getPassword())) {
      encodedPassword = updateUser.getPassword();
    } else  {
      // Update an JPA user with an encoded password.
      encodedPassword = PasswordEncoder.encode(user.getPassword(), user.getUsername());
    }

    // Only save internal roles
    Set<JpaRole> roles = UserDirectoryPersistenceUtil.saveRoles(filterRoles(user.getRoles()), emf);
    JpaOrganization organization = UserDirectoryPersistenceUtil.saveOrganization(
            (JpaOrganization) user.getOrganization(), emf);

    JpaUser updatedUser = UserDirectoryPersistenceUtil.saveUser(
            new JpaUser(user.getUsername(), encodedPassword, organization, user.getName(), user.getEmail(), user
                    .getProvider(), true, roles), emf);
    cache.put(user.getUsername() + DELIMITER + organization.getId(), updatedUser);

    updateGroupMembership(user);

    return updatedUser;
  }
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.