Duo IdPv3.3 c14n null principal.

[Cantor, Scott]

On 12/28/16, 1:30 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:

>    I am finding that, in the case where an intercept such as the expiring-password condition occurs, the principal is missing
> from the SubjectCanonicalizationContext, where I believe it was in fact set prior to leaving the authn/Password flow.

It shouldn't be set if the login flow fails and you should never, ever, ever set it yourself. That's an internal implementation detail.
 
>     It came to my attention because I was getting an NPE from the duo signRequest function in those cases where an
> intercept had occurred, but did not get the NPE when no intercept occurs between the factors.

Interceptors don't run between factors, "factors" are just an internal notion of the MFA flow.

> My solution is that I am having to have the intercept subflow(s) call the setPrincipal method on the c14n, which is working
> nicely.

No, don't do that.

-- Scott