Message Resolution Error on Invalid Credentials

[Marvin Addison]

I'm using JAAS for my CAS demo and it's working nicely with valid
credentials. For invalid credentials I'm getting an unexpected result.
I see the FailedLoginException I would expect for invalid JAAS
credentials:

13:06:28.115 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgain
stJAAS:200] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by 'john
' failed
javax.security.auth.login.FailedLoginException: null

Note the null error message, which I believe is not uncommon with JAAS
handlers. Immediately after I see an unexpected error:

13:06:28.117 - DEBUG
[org.springframework.webflow.engine.impl.FlowExecutionImpl:592] -
Attempting to handle
[org.springframework.webflow.execution.ActionExecutionException:
Exception thrown executing
net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS at 1b94be11
in state 'ValidateUsernamePassword' of flow 'authn/Password' -- action
execution attributes were 'map[[empty]]'] with root cause
[java.lang.NullPointerException]
13:06:28.117 - DEBUG
[org.springframework.webflow.engine.impl.FlowExecutionImpl:613] -
Rethrowing unhandled flow execution exception
13:06:28.117 - DEBUG
[org.springframework.webflow.conversation.impl.SessionBindingConversationManager:107]
- Unlocking conversation 1
13:06:28.118 - ERROR
[org.springframework.webflow.execution.ActionExecutionException:76] -
org.springframework.webflow.execution.ActionExecutionException:
Exception thrown executing
net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS at 1b94be11
in state 'ValidateUsernamePassword' of flow 'authn/Password' -- action
execution attributes were 'map[[empty]]'
...
Caused by: java.lang.NullPointerException: null
        at net.shibboleth.idp.authn.AbstractValidationAction$MessageChecker.apply(AbstractValidationAction.java:435)
~[idp-authn-api-3.0-SNAPSHOT.jar:na]

Best I can tell, this is caused by the null error message of the
thrown LoginException. The MessageChecker has what looks to be invalid
constraint logic that ought to provide a more helpful error message
than NPE:

        public MessageChecker(@Nonnull @NotEmpty final String msg) {
            Constraint.isNotNull(Strings.isNullOrEmpty(msg), "Message
cannot be null or empty");
            s = msg;
        }

That doesn't look right; I believe it should be the following:

Constraint.isFalse(Strings.isNullOrEmpty(msg), "Message cannot be null
or empty");

That wouldn't prevent the spurious error afaict, but it would provide
more helpful diagnostics. To get at the root error, it appears a
default error message needs to be provided to handleError when none is
given by the thrown exception. I'm fairly sure I've seen JAAS modules
simply throw LoginExceptions with empty messages, so I would expect
this to be a common case that needs to be handled.

If you agree this is a bug and my analysis is correct, I'm happy to
file a Jira issue.

M