Program: 3389
Project: 3389
Buggy source:
/** 
 * Authenticate the given username/password pair, in conjunction with the onBehalfOf user.  The rules are that the username/password pair must successfully authenticate the user, and the onBehalfOf user must exist in the user database.
 * @param un
 * @param pw
 * @param obo
 * @return	a SWORD context holding the various user information
 * @throws SWORDAuthenticationException
 * @throws SWORDException
 */
private SWORDContext authenticate(String un,String pw,String obo) throws SWORDAuthenticationException, SWORDException {
  if ("String_Node_Str".equals(obo)) {
    obo=null;
  }
  log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + un + "String_Node_Str"+ obo));
  try {
    SWORDContext sc=new SWORDContext();
    SWORDAuthentication auth=new SWORDAuthentication();
    EPerson ep=null;
    boolean authenticated=false;
    if (auth.authenticates(this.context,un,pw)) {
      ep=context.getCurrentUser();
      if (ep != null) {
        authenticated=true;
        sc.setAuthenticated(ep);
      }
      if (obo != null) {
        EPerson epObo=EPerson.findByEmail(this.context,obo);
        if (epObo != null) {
          sc.setOnBehalfOf(epObo);
        }
 else {
          authenticated=false;
        }
      }
    }
    if (ep != null && authenticated) {
      this.context.setCurrentUser(ep);
      log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + ep.getID()));
    }
 else {
      if (ep != null) {
        log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + un));
        throw new SWORDAuthenticationException("String_Node_Str");
      }
 else {
        log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + un + "String_Node_Str"+ obo));
        throw new SWORDAuthenticationException("String_Node_Str");
      }
    }
    return sc;
  }
 catch (  SQLException e) {
    log.error("String_Node_Str",e);
    throw new SWORDException("String_Node_Str",e);
  }
catch (  AuthorizeException e) {
    log.error("String_Node_Str",e);
    throw new SWORDAuthenticationException("String_Node_Str",e);
  }
}

Fixed version (ground truth):
/** 
 * Authenticate the given username/password pair, in conjunction with the onBehalfOf user.  The rules are that the username/password pair must successfully authenticate the user, and the onBehalfOf user must exist in the user database.
 * @param un
 * @param pw
 * @param obo
 * @return	a SWORD context holding the various user information
 * @throws SWORDAuthenticationException
 * @throws SWORDException
 */
private SWORDContext authenticate(Context context,String un,String pw,String obo) throws SWORDAuthenticationException, SWORDException {
  if ("String_Node_Str".equals(obo)) {
    obo=null;
  }
  log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + un + "String_Node_Str"+ obo));
  try {
    SWORDContext sc=new SWORDContext();
    SWORDAuthentication auth=new SWORDAuthentication();
    EPerson ep=null;
    boolean authenticated=false;
    if (auth.authenticates(context,un,pw)) {
      ep=context.getCurrentUser();
      if (ep != null) {
        authenticated=true;
        sc.setAuthenticated(ep);
      }
      if (obo != null) {
        EPerson epObo=EPerson.findByEmail(context,obo);
        if (epObo != null) {
          sc.setOnBehalfOf(epObo);
        }
 else {
          authenticated=false;
        }
      }
    }
    if (ep != null && authenticated) {
      context.setCurrentUser(ep);
      log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + ep.getID()));
    }
 else {
      if (ep != null) {
        log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + un));
        throw new SWORDAuthenticationException("String_Node_Str");
      }
 else {
        log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + un + "String_Node_Str"+ obo));
        throw new SWORDAuthenticationException("String_Node_Str");
      }
    }
    return sc;
  }
 catch (  SQLException e) {
    log.error("String_Node_Str",e);
    throw new SWORDException("String_Node_Str",e);
  }
catch (  AuthorizeException e) {
    log.error("String_Node_Str",e);
    throw new SWORDAuthenticationException("String_Node_Str",e);
  }
}