updateEPerson() is not testing for null strings with variables fname and lname and calling methods on them.
findHeader() is not testing for null param "name" and calling a method on it.
There should be an option whether to have updateEPerson called and so another configuration property should be set up for this. Not all Shibboleth providers send all the attributes (with or without values) of interest to this method. And even if they are there, not all institutions will want to update their EPersons in this way. Too many assumptions are made in this reimplementation of this class.