It appears Tuleap does not properly remove passwords of users authenticating via an OIDC provider from the database. This is unexpected since Tuleap do not let users authenticating via an OIDC provider to fallback to a password-based auth (this behavior is expected).

Tuleap cannot ask users to keep managing a password they cannot use. Passwords are considered PII, Tuleap should not store PII that are not absolutely needed for it to work (under GDPR this is called data minimization, see GDPR art 5.1.c).