Program: 79656
Project: 79656
Buggy source:
/** 
 * Once we're back from the ACS, we need to validate that we have not errored during the proxying process. Then we detect if we need to perform a local linking authentication chain, or if the user is already locally linked, we need to look up the already-linked username.
 */
private int handleReturnFromRedirect(final int state,final HttpServletRequest request,final String spName,final HttpServletResponse response) throws AuthLoginException {
  removeCookiesForRedirects(response);
  if (Boolean.parseBoolean(request.getParameter(SAML2Proxy.ERROR_PARAM_KEY))) {
    return handleRedirectError(request);
  }
  final String key;
  if (request.getParameter("String_Node_Str") != null) {
    key=JsonValueBuilder.toJsonValue(request.getParameter("String_Node_Str")).get("String_Node_Str").asString();
  }
 else {
    key=request.getParameter(SAML2Proxy.RESPONSE_KEY);
  }
  final String username;
  final SAML2ResponseData data;
  if (SAML2FailoverUtils.isSAML2FailoverEnabled() && !StringUtils.isBlank(key)) {
    try {
      data=(SAML2ResponseData)SAML2FailoverUtils.retrieveSAML2Token(key);
    }
 catch (    SAML2TokenRepositoryException e) {
      return processError(bundle.getString("String_Node_Str"),"String_Node_Str",e);
    }
  }
 else   if (!StringUtils.isBlank(key)) {
    data=(SAML2ResponseData)SAML2Store.getTokenFromStore(key);
  }
 else {
    return processError(bundle.getString("String_Node_Str"),"String_Node_Str" + "String_Node_Str");
  }
  assertionSubject=data.getSubject();
  authnAssertion=data.getAssertion();
  sessionIndex=data.getSessionIndex();
  respInfo=data.getResponseInfo();
  try {
    username=SPACSUtils.getPrincipalWithoutLogin(assertionSubject,authnAssertion,realm,spName,metaManager,entityName);
    if (username != null) {
      principal=new SAML2Principal(username);
      return success(authnAssertion,getNameId(),username);
    }
  }
 catch (  SAML2Exception e) {
    return processError(e,null,"String_Node_Str");
  }
  if (StringUtils.isBlank(localChain)) {
    return processError(bundle.getString("String_Node_Str"),"String_Node_Str" + "String_Node_Str");
  }
  authenticationContext=new AuthContext(realm);
  authenticationContext.login(AuthContext.IndexType.SERVICE,localChain,null,null,null,null);
  return injectCallbacks(null,state);
}

Fixed version (ground truth):
/** 
 * Once we're back from the ACS, we need to validate that we have not errored during the proxying process. Then we detect if we need to perform a local linking authentication chain, or if the user is already locally linked, we need to look up the already-linked username.
 */
private int handleReturnFromRedirect(final int state,final HttpServletRequest request,final String spName,final HttpServletResponse response) throws AuthLoginException {
  removeCookiesForRedirects(response);
  if (Boolean.parseBoolean(request.getParameter(SAML2Proxy.ERROR_PARAM_KEY))) {
    return handleRedirectError(request);
  }
  final String key;
  if (request.getParameter("String_Node_Str") != null) {
    key=JsonValueBuilder.toJsonValue(request.getParameter("String_Node_Str")).get("String_Node_Str").asString();
  }
 else {
    key=request.getParameter(SAML2Proxy.RESPONSE_KEY);
  }
  final String username;
  SAML2ResponseData data=null;
  if (!StringUtils.isBlank(key)) {
    data=(SAML2ResponseData)SAML2Store.getTokenFromStore(key);
  }
  if (data == null && SAML2FailoverUtils.isSAML2FailoverEnabled() && !StringUtils.isBlank(key)) {
    try {
      data=(SAML2ResponseData)SAML2FailoverUtils.retrieveSAML2Token(key);
    }
 catch (    SAML2TokenRepositoryException e) {
      return processError(bundle.getString("String_Node_Str"),"String_Node_Str",e);
    }
  }
  if (data == null) {
    return processError(bundle.getString("String_Node_Str"),"String_Node_Str" + "String_Node_Str");
  }
  storageKey=key;
  assertionSubject=data.getSubject();
  authnAssertion=data.getAssertion();
  sessionIndex=data.getSessionIndex();
  respInfo=data.getResponseInfo();
  try {
    username=SPACSUtils.getPrincipalWithoutLogin(assertionSubject,authnAssertion,realm,spName,metaManager,entityName,storageKey);
    if (username != null) {
      principal=new SAML2Principal(username);
      return success(authnAssertion,getNameId(),username);
    }
  }
 catch (  SAML2Exception e) {
    return processError(e,null,"String_Node_Str");
  }
  if (StringUtils.isBlank(localChain)) {
    return processError(bundle.getString("String_Node_Str"),"String_Node_Str" + "String_Node_Str");
  }
  authenticationContext=new AuthContext(realm);
  authenticationContext.login(AuthContext.IndexType.SERVICE,localChain,null,null,null,null);
  return injectCallbacks(null,state);
}