Program: 61052
Project: 61052
Buggy source:
public UserModalPage(final PageReference callerPageRef,final ModalWindow window,final UserTO userTO){
  super();
  if (userTO.getId() > 0) {
    cloneOldUserTO(userTO);
  }
  add(new Label("String_Node_Str",String.valueOf(userTO.getId())));
  final Form form=new Form("String_Node_Str");
  form.setModel(new CompoundPropertyModel(userTO));
  form.add(new AttributesPanel("String_Node_Str",userTO,form));
  final PasswordTextField password=new PasswordTextField("String_Node_Str");
  password.setRequired(userTO.getId() == 0);
  password.setResetPassword(true);
  form.add(password);
  final WebMarkupContainer mandatoryPassword=new WebMarkupContainer("String_Node_Str");
  mandatoryPassword.add(new Behavior(){
    private static final long serialVersionUID=1469628524240283489L;
    @Override public void onComponentTag(    final Component component,    final ComponentTag tag){
      if (userTO.getId() > 0) {
        tag.put("String_Node_Str","String_Node_Str");
      }
    }
  }
);
  form.add(mandatoryPassword);
  form.add(new DerivedAttributesPanel("String_Node_Str",userTO));
  form.add(new VirtualAttributesPanel("String_Node_Str",userTO));
  form.add(new ResourcesPanel("String_Node_Str",userTO));
  form.add(new RolesPanel("String_Node_Str",userTO));
  final AjaxButton submit=new IndicatingAjaxButton("String_Node_Str",new ResourceModel("String_Node_Str")){
    private static final long serialVersionUID=-958724007591692537L;
    @Override protected void onSubmit(    final AjaxRequestTarget target,    final Form form){
      final UserTO userTO=(UserTO)form.getModelObject();
      try {
        if (userTO.getId() == 0) {
          userRestClient.create(userTO);
        }
 else {
          setupUserMod(userTO);
          if (userMod != null) {
            userRestClient.update(userMod);
          }
        }
        ((Users)callerPageRef.getPage()).setModalResult(true);
        ((Users)callerPageRef.getPage()).getPageParameters().set(Constants.PAGEPARAM_CREATE,userTO.getId() == 0);
        window.close(target);
      }
 catch (      SyncopeClientCompositeErrorException e) {
        LOG.error("String_Node_Str",e);
        error(getString("String_Node_Str") + "String_Node_Str" + e.getMessage());
        target.add(feedbackPanel);
      }
    }
    @Override protected void onError(    AjaxRequestTarget target,    Form form){
      target.add(feedbackPanel);
    }
  }
;
  String allowedRoles=null;
  if (userTO.getId() == 0) {
    allowedRoles=xmlRolesReader.getAllAllowedRoles("String_Node_Str","String_Node_Str");
  }
 else {
    allowedRoles=xmlRolesReader.getAllAllowedRoles("String_Node_Str","String_Node_Str");
  }
  MetaDataRoleAuthorizationStrategy.authorize(submit,RENDER,allowedRoles);
  form.add(submit);
  add(form);
}

Fixed version (ground truth):
public UserModalPage(final PageReference callerPageRef,final ModalWindow window,final UserTO userTO){
  super();
  setBean(userTO);
  if (userTO.getId() > 0) {
    cloneOldUserTO(userTO);
  }
  add(new Label("String_Node_Str",String.valueOf(userTO.getId())));
  final Form form=new Form("String_Node_Str");
  form.setModel(new CompoundPropertyModel(userTO));
  form.add(new AttributesPanel("String_Node_Str",userTO,form));
  final PasswordTextField password=new PasswordTextField("String_Node_Str");
  password.setRequired(userTO.getId() == 0);
  password.setResetPassword(true);
  form.add(password);
  final WebMarkupContainer mandatoryPassword=new WebMarkupContainer("String_Node_Str");
  mandatoryPassword.add(new Behavior(){
    private static final long serialVersionUID=1469628524240283489L;
    @Override public void onComponentTag(    final Component component,    final ComponentTag tag){
      if (userTO.getId() > 0) {
        tag.put("String_Node_Str","String_Node_Str");
      }
    }
  }
);
  form.add(mandatoryPassword);
  form.add(new DerivedAttributesPanel("String_Node_Str",userTO));
  form.add(new VirtualAttributesPanel("String_Node_Str",userTO));
  form.add(new ResourcesPanel("String_Node_Str",userTO));
  form.add(new RolesPanel("String_Node_Str",userTO));
  final AjaxButton submit=new IndicatingAjaxButton("String_Node_Str",new ResourceModel("String_Node_Str")){
    private static final long serialVersionUID=-958724007591692537L;
    @Override protected void onSubmit(    final AjaxRequestTarget target,    final Form form){
      final UserTO userTO=(UserTO)form.getModelObject();
      try {
        if (userTO.getId() == 0) {
          userRestClient.create(userTO);
        }
 else {
          setupUserMod(userTO);
          if (userMod != null) {
            userRestClient.update(userMod);
          }
        }
        ((Users)callerPageRef.getPage()).setModalResult(true);
        ((Users)callerPageRef.getPage()).getPageParameters().set(Constants.PAGEPARAM_CREATE,userTO.getId() == 0);
        window.close(target);
      }
 catch (      SyncopeClientCompositeErrorException e) {
        LOG.error("String_Node_Str",e);
        error(getString("String_Node_Str") + "String_Node_Str" + e.getMessage());
        target.add(feedbackPanel);
      }
    }
    @Override protected void onError(    AjaxRequestTarget target,    Form form){
      target.add(feedbackPanel);
    }
  }
;
  String allowedRoles=null;
  if (userTO.getId() == 0) {
    allowedRoles=xmlRolesReader.getAllAllowedRoles("String_Node_Str","String_Node_Str");
  }
 else {
    allowedRoles=xmlRolesReader.getAllAllowedRoles("String_Node_Str","String_Node_Str");
  }
  MetaDataRoleAuthorizationStrategy.authorize(submit,RENDER,allowedRoles);
  form.add(submit);
  add(form);
}