[java-identity-provider COMMIT] /trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java

[noreply at shibboleth.net]

Author: scantor
Date: Wed Nov 16 14:33:23 2016
New Revision: 8569

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8569&view=rev
Log:
IDP-1089 - Duo flow doesn't guard against a null username

https://issues.shibboleth.net/jira/browse/IDP-1089

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java?rev=8569&r1=8568&r2=8569&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java	Wed Nov 16 14:33:23 2016
@@ -52,8 +52,14 @@
     @Nonnull @NotEmpty public static String generateSignedRequestToken(@Nonnull final DuoIntegration duo,
             @Nonnull @NotEmpty final String username)
             throws DuoWebException {
-        final String signedRequestToken = DuoWeb.signRequest(duo.getIntegrationKey(), duo.getSecretKey(),
-                duo.getApplicationKey(), username);
+        final String signedRequestToken;
+        
+        if (username == null) {
+            signedRequestToken = DuoWeb.ERR_USER;
+        } else {
+            signedRequestToken = DuoWeb.signRequest(duo.getIntegrationKey(), duo.getSecretKey(),
+                    duo.getApplicationKey(), username);
+        }
         if (signedRequestToken.startsWith("ERR|")) {
             throw new DuoWebException(signedRequestToken);
         }