Source:
<code>protected Credential constructCredentialsFromRequest(final RequestContext context) throws AccountException { final HttpServletRequest request = WebUtils.getHttpServletRequest(context); final OpenScienceFrameworkCredential credential = (OpenScienceFrameworkCredential) context.getFlowScope().get("credential"); final Cookie[] cookies = request.getCookies(); if (cookies != null) { final HttpServletResponse response = WebUtils.getHttpServletResponse(context); for (final Cookie cookie : cookies) { if (cookie.getName().startsWith(SHIBBOLETH_COOKIE_PREFIX)) { final Cookie shibbolethCookie = new Cookie(cookie.getName(), null); shibbolethCookie.setMaxAge(0); response.addCookie(shibbolethCookie); } } } final String shibbolethSession = request.getHeader(SHIBBOLETH_SESSION_HEADER); if (StringUtils.hasText(shibbolethSession)) { final String remoteUser = request.getHeader(REMOTE_USER); if (StringUtils.isEmpty(remoteUser)) { logger.error("Invalid Remote User specified as Empty"); throw new RemoteUserFailedLoginException("Invalid Remote User specified as Empty"); } logger.info("Remote User from HttpServletRequest '{}'", remoteUser); credential.setRemotePrincipal(Boolean.TRUE); for (final String headerName : Collections.list(request.getHeaderNames())) { if (headerName.startsWith(ATTRIBUTE_PREFIX)) { final String headerValue = request.getHeader(headerName); logger.debug("Remote User Auth Header '{}': '{}'", remoteUser, headerName, headerValue); credential.getAuthenticationHeaders().put( headerName.substring(ATTRIBUTE_PREFIX.length()), headerValue ); } } final String username = notifyRemotePrincipalAuthenticated(credential); credential.setUsername(username); return credential; } <START> else if (request.getParameter("verification_key") != null) { <END> credential.setUsername(request.getParameter("username")); credential.setVerificationKey(request.getParameter("verification_key")); return credential; } return null; }</code><technical_language>add a check for username here</technical_language>

Target:
protected Credential constructCredentialsFromRequest(final RequestContext context) throws AccountException { final HttpServletRequest request = WebUtils.getHttpServletRequest(context); final OpenScienceFrameworkCredential credential = (OpenScienceFrameworkCredential) context.getFlowScope().get("credential"); final Cookie[] cookies = request.getCookies(); if (cookies != null) { final HttpServletResponse response = WebUtils.getHttpServletResponse(context); for (final Cookie cookie : cookies) { if (cookie.getName().startsWith(SHIBBOLETH_COOKIE_PREFIX)) { final Cookie shibbolethCookie = new Cookie(cookie.getName(), null); shibbolethCookie.setMaxAge(0); response.addCookie(shibbolethCookie); } } } final String shibbolethSession = request.getHeader(SHIBBOLETH_SESSION_HEADER); if (StringUtils.hasText(shibbolethSession)) { final String remoteUser = request.getHeader(REMOTE_USER); if (StringUtils.isEmpty(remoteUser)) { logger.error("Invalid Remote User specified as Empty"); throw new RemoteUserFailedLoginException("Invalid Remote User specified as Empty"); } logger.info("Remote User from HttpServletRequest '{}'", remoteUser); credential.setRemotePrincipal(Boolean.TRUE); for (final String headerName : Collections.list(request.getHeaderNames())) { if (headerName.startsWith(ATTRIBUTE_PREFIX)) { final String headerValue = request.getHeader(headerName); logger.debug("Remote User Auth Header '{}': '{}'", remoteUser, headerName, headerValue); credential.getAuthenticationHeaders().put( headerName.substring(ATTRIBUTE_PREFIX.length()), headerValue ); } } final String username = notifyRemotePrincipalAuthenticated(credential); credential.setUsername(username); return credential; } else if (request.getParameter("username") != null && request.getParameter("verification_key") != null) { credential.setUsername(request.getParameter("username")); credential.setVerificationKey(request.getParameter("verification_key")); return credential; } return null; }