<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I'm not sure if I understand the source code correctly. From Developer's source code, I find there's no value check for activeResult before calling a function from the instance. This seems to cause the java.lang.NullPointerException error.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span class="pre" style="font-family:monospace;font-size:small;background-color:rgb(255, 255, 255)"><a href="https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l202" class="linenr" style="color:rgb(153, 153, 153)"> 202</a> if (!authenticationContext.isForceAuthn()) {</span>
<div class="pre" style="font-family:monospace;font-size:small;background-color:rgb(255, 255, 255)">
<a href="https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l203" class="linenr" style="color:rgb(153, 153, 153)"> 203</a> activeResult = authenticationContext.getActiveResults().get(flow.getId());</div>
<div class="pre" style="font-family:monospace;font-size:small;background-color:rgb(255, 255, 255)">
<a href="https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l204" class="linenr" style="color:rgb(153, 153, 153)"> 204</a> if (!activeResult.getReuseCondition().test(profileRequestContext)) {</div>
<div class="pre" style="font-family:monospace;font-size:small;background-color:rgb(255, 255, 255)">
<a href="https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l205" class="linenr" style="color:rgb(153, 153, 153)"> 205</a> log.debug("{} Active result for flow {} not reusable, ignoring", getLogPrefix(),</div>
<div class="pre" style="font-family:monospace;font-size:small;background-color:rgb(255, 255, 255)">
<a href="https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l206" class="linenr" style="color:rgb(153, 153, 153)"> 206</a> activeResult.getAuthenticationFlowId());</div>
<div class="pre" style="font-family:monospace;font-size:small;background-color:rgb(255, 255, 255)">
<a href="https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l207" class="linenr" style="color:rgb(153, 153, 153)"> 207</a> activeResult = null;</div>
<div class="pre" style="font-family:monospace;font-size:small;background-color:rgb(255, 255, 255)">
<a href="https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l208" class="linenr" style="color:rgb(153, 153, 153)"> 208</a> }</div>
<span class="pre" style="font-family:monospace;font-size:small;background-color:rgb(255, 255, 255)"><a href="https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java;h=c530a1a0445606d80dbdb66558d740303cbeb930;hb=HEAD#l209" class="linenr" style="color:rgb(153, 153, 153)"> 209</a> }</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p style="margin-top: 0px; margin-bottom: 0px;margin-top:0; margin-bottom:0"><span id="ms-rterangepaste-start"></span></p>
<pre class="moz-signature" cols="72"><span style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;">Zunan Dong</span><br></pre>
<pre class="moz-signature" cols="72">Authentication Systems Specialist</pre>
<pre class="moz-signature" cols="72">Information Security
Information Technology Service
University of Toronto
Email: zunan.dong@utoronto.ca</pre>
<span id="ms-rterangepaste-end"></span><br>
<p style="margin-top: 0px; margin-bottom: 0px;"></p>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Zunan Dong <zunan.dong@utoronto.ca><br>
<b>Sent:</b> Monday, 01 February 2021 13:00<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Add Alternative Authentication Flow on the Login Page</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div style="font-size:10pt; font-family:sans-serif; color:white; font-style:normal; font-weight:bold; padding:.2em">
<strong><span style="color:#c75000">EXTERNAL EMAIL:</span></strong></div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hi,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I'm trying to add a button to trigger X509 authentication flow on Duo login page. I put the following code after the Duo iframe.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<form action="$flowExecutionUrl" method="post">
<div> <button type="submit" name="_eventId_authn/X509" class="btn btn-primary btn-lg">Login with eToken</button></div>
</form><br>
</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
This button should reselect the authentication flow, authn/x509. It works well in v3.3.0. However, after we upgrade our UAT IdP to v4.0.1, this only works for service providers with force authentication enabled. For other service providers, we get the following
error message after click on the button.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
- DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:214] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/Duo'
<div> - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:231] - Profile Action TransitionMultiFactorAuthentication: MFA flow completing with event 'ReselectFlow'</div>
<div> - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/MFA to intermediate set</div>
<div> - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:190] - Profile Action SelectAuthenticationFlow: Attempting to honor signaled flow authn/X509</div>
<div> - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception</div>
<div>java.lang.NullPointerException: null</div>
<div> at net.shibboleth.idp.authn.impl.SelectAuthenticationFlow.doSelectSignaledFlow(SelectAuthenticationFlow.java:204)</div>
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Am I doing anything wrong? Any suggestions will be appreciated.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thanks,</div>
<div id="x_Signature">
<div>
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0"><span id="x_ms-rterangepaste-start"></span></p>
<pre class="x_moz-signature" cols="72">Zunan Dong</pre>
<pre class="x_moz-signature" cols="72">Authentication Systems Specialist</pre>
<pre class="x_moz-signature" cols="72">Information Security
Information Technology Service
University of Toronto
Email: zunan.dong@utoronto.ca</pre>
<span id="x_ms-rterangepaste-end"></span><br>
<p style="margin-top:0px; margin-bottom:0px"></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>