JSON UserDetails deserializes null

JSON UserDetails null use to be treated as "".

This changes null to be treated as a null

Issue gh-3736

core/src/main/java/org/springframework/security/jackson2/UserDeserializer.java

@@ -58,12 +58,18 @@ class UserDeserializer extends JsonDeserializer<User> {
 		JsonNode jsonNode = mapper.readTree(jp);
 		Set<GrantedAuthority> authorities = mapper.convertValue(jsonNode.get("authorities"), new TypeReference<Set<SimpleGrantedAuthority>>() {
 		});
-		return new User(
-				readJsonNode(jsonNode, "username").asText(), readJsonNode(jsonNode, "password").asText(""),
+		JsonNode password = readJsonNode(jsonNode, "password");
+		User result =  new User(
+				readJsonNode(jsonNode, "username").asText(), password.asText(""),
 				readJsonNode(jsonNode, "enabled").asBoolean(), readJsonNode(jsonNode, "accountNonExpired").asBoolean(),
 				readJsonNode(jsonNode, "credentialsNonExpired").asBoolean(),
 				readJsonNode(jsonNode, "accountNonLocked").asBoolean(), authorities
 		);
+		
+		if(password.asText(null) == null) {
+			result.eraseCredentials();
+		}
+		return result;
 	}
 
 	private JsonNode readJsonNode(JsonNode jsonNode, String field) {

core/src/test/java/org/springframework/security/jackson2/UserDeserializerTests.java

@@ -80,8 +80,8 @@ public class UserDeserializerTests extends AbstractMixinTests {
 		User user = mapper.readValue(userJsonWithoutPasswordString, User.class);
 		assertThat(user).isNotNull();
 		assertThat(user.getUsername()).isEqualTo("admin");
-		assertThat(user.getPassword()).isEqualTo("");
-		assertThat(user.getAuthorities()).hasSize(0);
+		assertThat(user.getPassword()).isNull();
+		assertThat(user.getAuthorities()).isEmpty();
 		assertThat(user.isEnabled()).isEqualTo(true);
 	}