[java-identity-provider COMMIT] /branches/3.3/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSuppo...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Mar  6 17:00:30 2017
New Revision: 8652

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8652&view=rev
Log:
BPr8569 - IDP-1089 - Duo flow doesn't guard against a null username

Modified:
    branches/3.3/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java

Modified: branches/3.3/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java
URL: http://svn.shibboleth.net/view/java-identity-provider/branches/3.3/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java?rev=8652&r1=8651&r2=8652&view=diff
==============================================================================
--- branches/3.3/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java	(original)
+++ branches/3.3/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java	Mon Mar  6 17:00:30 2017
@@ -52,8 +52,14 @@
     @Nonnull @NotEmpty public static String generateSignedRequestToken(@Nonnull final DuoIntegration duo,
             @Nonnull @NotEmpty final String username)
             throws DuoWebException {
-        final String signedRequestToken = DuoWeb.signRequest(duo.getIntegrationKey(), duo.getSecretKey(),
-                duo.getApplicationKey(), username);
+        final String signedRequestToken;
+        
+        if (username == null) {
+            signedRequestToken = DuoWeb.ERR_USER;
+        } else {
+            signedRequestToken = DuoWeb.signRequest(duo.getIntegrationKey(), duo.getSecretKey(),
+                    duo.getApplicationKey(), username);
+        }
         if (signedRequestToken.startsWith("ERR|")) {
             throw new DuoWebException(signedRequestToken);
         }