Duo IdPv3.3 c14n null principal.

[Cantor, Scott]

On 12/28/16, 1:30 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:

>    I am finding that, in the case where an intercept such as the expiring-password condition occurs, the principal is missing
> from the SubjectCanonicalizationContext, where I believe it was in fact set prior to leaving the authn/Password flow.

I think you're talking about the *condition* hook there, not the interceptor. Those are different things, and I think there's a regression/bug in the use of the condition thing. That's mostly legacy at this point, but it's a bug, it's skipping the c14n bits, which will cause problems in a number of newer cases.
 
>     It came to my attention because I was getting an NPE from the duo signRequest function in those cases where an
> intercept had occurred, but did not get the NPE when no intercept occurs between the factors.

I was thrown by the use of that term, but these aren't intercepts.

Please file a bug, but again for the record, you can't fix it by manually setting a field in a structure. It's literally *not* doing c14n at all, which has all sorts of potential implications that would depend on what you're doing there. If your c14n logic is "do nothing" (i.e. just accept the user-supplied username) then that's no big deal, but in many cases that isn't what people are doing and it wouldn't give the expected results.

-- Scott