random Subject after removing PreviousSessionLoginHandler

[Burchhart Markus DEA sIT]

Hello all,

after removing PreviousSessionLoginHandler from our Shibboleth-IdP configuration we wonder about the new IdP behaviour:
After the second succsessful logins we sometimes get an assertion with the FIRST login-subject returned.

Steps to Reproduce:
1. Request a SP-driven Login
2. Login with user1
3. SP accepts Assertion
4. Logout local at the SP
5. Request a SP-driven Login AGAIN
6. Login with user2
7. IdP returns Assertion with random-choosen user (user1 or user2 -> BUG)

I would expect as the right behavior in step 7 user2 to be returned. But with a probability of ~50% we get user1 returned.

(Hint: If your got user1 try to destroy you IdP Session (e.g. close your browser) an redo Step 1. To 7. with user2 first)


Reason (Shibboleth 2.3.8):
AuthenticationEngine:747 contains a method mergeSubjects(...) which joins together the old and new subject in a HashSet.
As mergeSubjects(...) is a documented method, it dont seems like a bug by accident.

Question 1:
Is reauthentication against Shibboleth-IDP stable without PreviousSessionLoginHandler?
How can I ensure that the old session is destroy when relogin is successful?

Question 2:
How can I deactivate the SSO on per SP-basis?


Best Regards
  Markus Burchhart