Program: 105214
Project: 105214
Buggy source:
@Override public String authenticate(final String command,final Map<String,Object[]> params,final HttpSession session,final String remoteAddress,final String responseType,final StringBuilder auditTrailSb,final HttpServletRequest req,final HttpServletResponse resp) throws ServerApiException {
  if (session == null || session.isNew()) {
    throw new ServerApiException(ApiErrorCode.UNAUTHORIZED,_apiServer.getSerializedApiError(ApiErrorCode.UNAUTHORIZED.getHttpCode(),"String_Node_Str",params,responseType));
  }
  if (!HttpUtils.validateSessionKey(session,params,req.getCookies(),ApiConstants.SESSIONKEY)) {
    throw new ServerApiException(ApiErrorCode.UNAUTHORIZED,_apiServer.getSerializedApiError(ApiErrorCode.UNAUTHORIZED.getHttpCode(),"String_Node_Str",params,responseType));
  }
  final long currentUserId=(Long)session.getAttribute("String_Node_Str");
  final UserAccount currentUserAccount=_accountService.getUserAccountById(currentUserId);
  if (currentUserAccount == null || currentUserAccount.getSource() != User.Source.SAML2) {
    throw new ServerApiException(ApiErrorCode.ACCOUNT_ERROR,_apiServer.getSerializedApiError(ApiErrorCode.ACCOUNT_ERROR.getHttpCode(),"String_Node_Str",params,responseType));
  }
  String userUuid=null;
  String domainUuid=null;
  if (params.containsKey(ApiConstants.USER_ID)) {
    userUuid=((String[])params.get(ApiConstants.USER_ID))[0];
  }
  if (params.containsKey(ApiConstants.DOMAIN_ID)) {
    domainUuid=((String[])params.get(ApiConstants.DOMAIN_ID))[0];
  }
  if (userUuid != null && domainUuid != null) {
    final User user=_userDao.findByUuid(userUuid);
    final Domain domain=_domainDao.findByUuid(domainUuid);
    final UserAccount nextUserAccount=_accountService.getUserAccountById(user.getId());
    if (nextUserAccount != null && !nextUserAccount.getAccountState().equals(Account.State.enabled.toString())) {
      throw new ServerApiException(ApiErrorCode.ACCOUNT_ERROR,_apiServer.getSerializedApiError(ApiErrorCode.PARAM_ERROR.getHttpCode(),"String_Node_Str",params,responseType));
    }
    if (nextUserAccount == null || !nextUserAccount.getAccountState().equals(Account.State.enabled.toString()) || !nextUserAccount.getUsername().equals(currentUserAccount.getUsername()) || !nextUserAccount.getExternalEntity().equals(currentUserAccount.getExternalEntity()) || (nextUserAccount.getDomainId() != domain.getId()) || (nextUserAccount.getSource() != User.Source.SAML2)) {
      throw new ServerApiException(ApiErrorCode.PARAM_ERROR,_apiServer.getSerializedApiError(ApiErrorCode.PARAM_ERROR.getHttpCode(),"String_Node_Str",params,responseType));
    }
    try {
      if (_apiServer.verifyUser(nextUserAccount.getId())) {
        final LoginCmdResponse loginResponse=(LoginCmdResponse)_apiServer.loginUser(session,nextUserAccount.getUsername(),nextUserAccount.getUsername() + nextUserAccount.getSource().toString(),nextUserAccount.getDomainId(),null,remoteAddress,params);
        SAMLUtils.setupSamlUserCookies(loginResponse,resp);
        resp.sendRedirect(SAML2AuthManager.SAMLCloudStackRedirectionUrl.value());
        return ApiResponseSerializer.toSerializedString(loginResponse,responseType);
      }
    }
 catch (    CloudAuthenticationException|IOException exception) {
      s_logger.debug("String_Node_Str" + exception.getMessage());
    }
  }
 else {
    List<UserAccountVO> switchableAccounts=_userAccountDao.getAllUsersByNameAndEntity(currentUserAccount.getUsername(),currentUserAccount.getExternalEntity());
    if (switchableAccounts != null && switchableAccounts.size() > 0 && currentUserId != User.UID_SYSTEM) {
      List<SamlUserAccountResponse> accountResponses=new ArrayList<SamlUserAccountResponse>();
      for (      UserAccountVO userAccount : switchableAccounts) {
        User user=_userDao.getUser(userAccount.getId());
        Domain domain=_domainService.getDomain(userAccount.getDomainId());
        SamlUserAccountResponse accountResponse=new SamlUserAccountResponse();
        accountResponse.setUserId(user.getUuid());
        accountResponse.setUserName(user.getUsername());
        accountResponse.setDomainId(domain.getUuid());
        accountResponse.setDomainName(domain.getName());
        accountResponse.setAccountName(userAccount.getAccountName());
        accountResponse.setIdpId(user.getExternalEntity());
        accountResponses.add(accountResponse);
      }
      ListResponse<SamlUserAccountResponse> response=new ListResponse<SamlUserAccountResponse>();
      response.setResponses(accountResponses);
      response.setResponseName(getCommandName());
      return ApiResponseSerializer.toSerializedString(response,responseType);
    }
  }
  throw new ServerApiException(ApiErrorCode.ACCOUNT_ERROR,_apiServer.getSerializedApiError(ApiErrorCode.ACCOUNT_ERROR.getHttpCode(),"String_Node_Str",params,responseType));
}

Fixed version (ground truth):
@Override public String authenticate(final String command,final Map<String,Object[]> params,final HttpSession session,InetAddress remoteAddress,final String responseType,final StringBuilder auditTrailSb,final HttpServletRequest req,final HttpServletResponse resp) throws ServerApiException {
  if (session == null || session.isNew()) {
    throw new ServerApiException(ApiErrorCode.UNAUTHORIZED,_apiServer.getSerializedApiError(ApiErrorCode.UNAUTHORIZED.getHttpCode(),"String_Node_Str",params,responseType));
  }
  if (!HttpUtils.validateSessionKey(session,params,req.getCookies(),ApiConstants.SESSIONKEY)) {
    throw new ServerApiException(ApiErrorCode.UNAUTHORIZED,_apiServer.getSerializedApiError(ApiErrorCode.UNAUTHORIZED.getHttpCode(),"String_Node_Str",params,responseType));
  }
  final long currentUserId=(Long)session.getAttribute("String_Node_Str");
  final UserAccount currentUserAccount=_accountService.getUserAccountById(currentUserId);
  if (currentUserAccount == null || currentUserAccount.getSource() != User.Source.SAML2) {
    throw new ServerApiException(ApiErrorCode.ACCOUNT_ERROR,_apiServer.getSerializedApiError(ApiErrorCode.ACCOUNT_ERROR.getHttpCode(),"String_Node_Str",params,responseType));
  }
  String userUuid=null;
  String domainUuid=null;
  if (params.containsKey(ApiConstants.USER_ID)) {
    userUuid=((String[])params.get(ApiConstants.USER_ID))[0];
  }
  if (params.containsKey(ApiConstants.DOMAIN_ID)) {
    domainUuid=((String[])params.get(ApiConstants.DOMAIN_ID))[0];
  }
  if (userUuid != null && domainUuid != null) {
    final User user=_userDao.findByUuid(userUuid);
    final Domain domain=_domainDao.findByUuid(domainUuid);
    final UserAccount nextUserAccount=_accountService.getUserAccountById(user.getId());
    if (nextUserAccount != null && !nextUserAccount.getAccountState().equals(Account.State.enabled.toString())) {
      throw new ServerApiException(ApiErrorCode.ACCOUNT_ERROR,_apiServer.getSerializedApiError(ApiErrorCode.PARAM_ERROR.getHttpCode(),"String_Node_Str",params,responseType));
    }
    if (nextUserAccount == null || !nextUserAccount.getAccountState().equals(Account.State.enabled.toString()) || !nextUserAccount.getUsername().equals(currentUserAccount.getUsername()) || !nextUserAccount.getExternalEntity().equals(currentUserAccount.getExternalEntity()) || (nextUserAccount.getDomainId() != domain.getId()) || (nextUserAccount.getSource() != User.Source.SAML2)) {
      throw new ServerApiException(ApiErrorCode.PARAM_ERROR,_apiServer.getSerializedApiError(ApiErrorCode.PARAM_ERROR.getHttpCode(),"String_Node_Str",params,responseType));
    }
    try {
      if (_apiServer.verifyUser(nextUserAccount.getId())) {
        final LoginCmdResponse loginResponse=(LoginCmdResponse)_apiServer.loginUser(session,nextUserAccount.getUsername(),nextUserAccount.getUsername() + nextUserAccount.getSource().toString(),nextUserAccount.getDomainId(),null,remoteAddress,params);
        SAMLUtils.setupSamlUserCookies(loginResponse,resp);
        resp.sendRedirect(SAML2AuthManager.SAMLCloudStackRedirectionUrl.value());
        return ApiResponseSerializer.toSerializedString(loginResponse,responseType);
      }
    }
 catch (    CloudAuthenticationException|IOException exception) {
      s_logger.debug("String_Node_Str" + exception.getMessage());
    }
  }
 else {
    List<UserAccountVO> switchableAccounts=_userAccountDao.getAllUsersByNameAndEntity(currentUserAccount.getUsername(),currentUserAccount.getExternalEntity());
    if (switchableAccounts != null && switchableAccounts.size() > 0 && currentUserId != User.UID_SYSTEM) {
      List<SamlUserAccountResponse> accountResponses=new ArrayList<SamlUserAccountResponse>();
      for (      UserAccountVO userAccount : switchableAccounts) {
        User user=_userDao.getUser(userAccount.getId());
        Domain domain=_domainService.getDomain(userAccount.getDomainId());
        SamlUserAccountResponse accountResponse=new SamlUserAccountResponse();
        accountResponse.setUserId(user.getUuid());
        accountResponse.setUserName(user.getUsername());
        accountResponse.setDomainId(domain.getUuid());
        accountResponse.setDomainName(domain.getName());
        accountResponse.setAccountName(userAccount.getAccountName());
        accountResponse.setIdpId(user.getExternalEntity());
        accountResponses.add(accountResponse);
      }
      ListResponse<SamlUserAccountResponse> response=new ListResponse<SamlUserAccountResponse>();
      response.setResponses(accountResponses);
      response.setResponseName(getCommandName());
      return ApiResponseSerializer.toSerializedString(response,responseType);
    }
  }
  throw new ServerApiException(ApiErrorCode.ACCOUNT_ERROR,_apiServer.getSerializedApiError(ApiErrorCode.ACCOUNT_ERROR.getHttpCode(),"String_Node_Str",params,responseType));
}