Add Alternative Authentication Flow on the Login Page

[Zunan Dong]

I'm not sure if I understand the source code correctly. From Developer's source code, I find there's no value check for activeResult before calling a function from the instance. This seems to cause the java.lang.NullPointerException error.

 202<https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l202>         if (!authenticationContext.isForceAuthn()) {
 203<https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l203>             activeResult = authenticationContext.getActiveResults().get(flow.getId());
 204<https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l204>             if (!activeResult.getReuseCondition().test(profileRequestContext)) {
 205<https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l205>                 log.debug("{} Active result for flow {} not reusable, ignoring", getLogPrefix(),
 206<https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l206>                         activeResult.getAuthenticationFlowId());
 207<https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l207>                 activeResult = null;
 208<https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l208>             }
 209<https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l209>         }



Zunan Dong

Authentication Systems Specialist

Information Security

Information Technology Service

University of Toronto

Email: zunan.dong at utoronto.ca


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Zunan Dong <zunan.dong at utoronto.ca>
Sent: Monday, 01 February 2021 13:00
To: Shib Users <users at shibboleth.net>
Subject: Add Alternative Authentication Flow on the Login Page

EXTERNAL EMAIL:
Hi,

I'm trying to add a button to trigger X509 authentication flow on Duo login page. I put the following code after the Duo iframe.

<form action="$flowExecutionUrl" method="post">
          <button type="submit" name="_eventId_authn/X509" class="btn btn-primary btn-lg">Login with eToken</button>
</form>

This button should reselect the authentication flow, authn/x509. It works well in v3.3.0. However, after we upgrade our UAT IdP to v4.0.1, this only works for service providers with force authentication enabled. For other service providers, we get the following error message after click on the button.

- DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:214] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/Duo'
 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:231] - Profile Action TransitionMultiFactorAuthentication: MFA flow completing with event 'ReselectFlow'
 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/MFA to intermediate set
 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:190] - Profile Action SelectAuthenticationFlow: Attempting to honor signaled flow authn/X509
 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception
java.lang.NullPointerException: null
        at net.shibboleth.idp.authn.impl.SelectAuthenticationFlow.doSelectSignaledFlow(SelectAuthenticationFlow.java:204)

Am I doing anything wrong? Any suggestions will be appreciated.

Thanks,

Zunan Dong

Authentication Systems Specialist

Information Security

Information Technology Service

University of Toronto

Email: zunan.dong at utoronto.ca

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210201/b8be2a0a/attachment.htm>