Program: 9059
Project: 9059
Buggy source:
/** 
 * Performs similar to SPSSOFederate.initiateAuthnRequest by returning to the next auth stage with a redirect (either GET or POST depending on the config) which triggers remote IdP authentication.
 */
private int initiateSAMLLoginAtIDP(final HttpServletResponse response,final HttpServletRequest request) throws SAML2Exception, AuthLoginException {
  if (reqBinding == null) {
    reqBinding=SAML2Constants.HTTP_REDIRECT;
  }
  final String spEntityID=SPSSOFederate.getSPEntityId(metaAlias);
  final IDPSSODescriptorElement idpsso=SPSSOFederate.getIDPSSOForAuthnReq(realm,entityName);
  final SPSSODescriptorElement spsso=SPSSOFederate.getSPSSOForAuthnReq(realm,spEntityID);
  if (idpsso == null || spsso == null) {
    return processError(bundle.getString("String_Node_Str"),"String_Node_Str",bundle.getString("String_Node_Str"));
  }
  final String ssoURL=SPSSOFederate.getSSOURL(idpsso.getSingleSignOnService(),reqBinding);
  final List extensionsList=SPSSOFederate.getExtensionsList(spEntityID,realm);
  final Map<String,Collection<String>> spConfigAttrsMap=SPSSOFederate.getAttrsMapForAuthnReq(realm,spEntityID);
  final AuthnRequest authnRequest=SPSSOFederate.createAuthnRequest(realm,spEntityID,params,spConfigAttrsMap,extensionsList,spsso,idpsso,ssoURL,false);
  final AuthnRequestInfo reqInfo=new AuthnRequestInfo(request,response,realm,spEntityID,null,authnRequest,null,params);
synchronized (SPCache.requestHash) {
    SPCache.requestHash.put(authnRequest.getID(),reqInfo);
  }
  saveAuthnRequestIfFailoverEnabled(authnRequest,reqInfo);
  final Callback[] nextCallbacks=getCallback(REDIRECT);
  final RedirectCallback redirectCallback=(RedirectCallback)nextCallbacks[0];
  setCookiesForRedirects(request,response);
  if (SAML2Constants.HTTP_POST.equals(reqBinding)) {
    final String postMsg=SPSSOFederate.getPostBindingMsg(idpsso,spsso,spConfigAttrsMap,authnRequest);
    configurePostRedirectCallback(postMsg,ssoURL,redirectCallback);
  }
 else {
    final String authReqXMLString=authnRequest.toXMLString(true,true);
    final String redirectUrl=SPSSOFederate.getRedirect(authReqXMLString,null,ssoURL,idpsso,spsso,spConfigAttrsMap);
    configureGetRedirectCallback(redirectUrl,redirectCallback);
  }
  return REDIRECT;
}

Fixed version (ground truth):
/** 
 * Performs similar to SPSSOFederate.initiateAuthnRequest by returning to the next auth stage with a redirect (either GET or POST depending on the config) which triggers remote IdP authentication.
 */
private int initiateSAMLLoginAtIDP(final HttpServletResponse response,final HttpServletRequest request) throws SAML2Exception, AuthLoginException {
  if (reqBinding == null) {
    reqBinding=SAML2Constants.HTTP_REDIRECT;
  }
  final String spEntityID=SPSSOFederate.getSPEntityId(metaAlias);
  final IDPSSODescriptorElement idpsso=SPSSOFederate.getIDPSSOForAuthnReq(realm,entityName);
  final SPSSODescriptorElement spsso=SPSSOFederate.getSPSSOForAuthnReq(realm,spEntityID);
  if (idpsso == null || spsso == null) {
    return processError(bundle.getString("String_Node_Str"),"String_Node_Str",bundle.getString("String_Node_Str"));
  }
  final String ssoURL=SPSSOFederate.getSSOURL(idpsso.getSingleSignOnService(),reqBinding);
  final List extensionsList=SPSSOFederate.getExtensionsList(spEntityID,realm);
  final Map<String,Collection<String>> spConfigAttrsMap=SPSSOFederate.getAttrsMapForAuthnReq(realm,spEntityID);
  authnRequest=SPSSOFederate.createAuthnRequest(realm,spEntityID,params,spConfigAttrsMap,extensionsList,spsso,idpsso,ssoURL,false);
  final AuthnRequestInfo reqInfo=new AuthnRequestInfo(request,response,realm,spEntityID,null,authnRequest,null,params);
synchronized (SPCache.requestHash) {
    SPCache.requestHash.put(authnRequest.getID(),reqInfo);
  }
  saveAuthnRequest(authnRequest,reqInfo);
  final Callback[] nextCallbacks=getCallback(REDIRECT);
  final RedirectCallback redirectCallback=(RedirectCallback)nextCallbacks[0];
  setCookiesForRedirects(request,response);
  if (SAML2Constants.HTTP_POST.equals(reqBinding)) {
    final String postMsg=SPSSOFederate.getPostBindingMsg(idpsso,spsso,spConfigAttrsMap,authnRequest);
    configurePostRedirectCallback(postMsg,ssoURL,redirectCallback);
  }
 else {
    final String authReqXMLString=authnRequest.toXMLString(true,true);
    final String redirectUrl=SPSSOFederate.getRedirect(authReqXMLString,null,ssoURL,idpsso,spsso,spConfigAttrsMap);
    configureGetRedirectCallback(redirectUrl,redirectCallback);
  }
  return REDIRECT;
}