private static void federatedFlowStep2(
      LoginInput loginInput,
      String tokenUrl,
      String ssoUrl) throws SnowflakeSQLException
  {
    try
    {
      if (!isPrefixEqual(loginInput.getAuthenticator(), tokenUrl) ||
          !isPrefixEqual(loginInput.getAuthenticator(), ssoUrl))
      {
        logger.debug("The specified authenticator {} is not supported.",
                     loginInput.getAuthenticator());
        throw new SnowflakeSQLException(
            SqlState.SQLCLIENT_UNABLE_TO_ESTABLISH_SQLCONNECTION,
            ErrorCode.IDP_CONNECTION_ERROR.getMessageCode());
      }
    }
    catch (MalformedURLException ex)
    {
      handleFederatedFlowError(loginInput, ex);
    }
  }
private static void federatedFlowStep2 ( LoginInput loginInput , String tokenUrl , String ssoUrl ) throws SnowflakeSQLException { try { if ( ! isPrefixEqual ( loginInput . getAuthenticator ( ) , tokenUrl ) || ! isPrefixEqual ( loginInput . getAuthenticator ( ) , ssoUrl ) ) { logger . debug ( "The specified authenticator {} is not supported." , loginInput . getAuthenticator ( ) ) ; throw new SnowflakeSQLException ( SqlState . SQLCLIENT_UNABLE_TO_ESTABLISH_SQLCONNECTION , ErrorCode . IDP_CONNECTION_ERROR . getMessageCode ( ) ) ; } } catch ( MalformedURLException ex ) { handleFederatedFlowError ( loginInput , ex ) ; } }
Perform important client side validation:
validate both token url and sso url contains same prefix
(protocol + host + port) as the given authenticator url.
Explanation:
This provides a way for the user to 'authenticate' the IDP it is
sending his/her credentials to.  Without such a check, the user could
be coerced to provide credentials to an IDP impersonator.

@param loginInput
@param tokenUrl
@param ssoUrl
@throws SnowflakeSQLException