random Subject after removing PreviousSessionLoginHandler

[Kevin P. Foote]

Markus - Just curious is there a custom login handler involved here?

------
thanks
  kevin.foote

On Thu, 10 Jan 2013, Burchhart Markus DEA sIT wrote:

-> Hello all,
-> 
-> after removing PreviousSessionLoginHandler from our Shibboleth-IdP configuration we wonder about the new IdP behaviour:
-> After the second succsessful logins we sometimes get an assertion with the FIRST login-subject returned.
-> 
-> Steps to Reproduce:
-> 1. Request a SP-driven Login
-> 2. Login with user1
-> 3. SP accepts Assertion
-> 4. Logout local at the SP
-> 5. Request a SP-driven Login AGAIN
-> 6. Login with user2
-> 7. IdP returns Assertion with random-choosen user (user1 or user2 -> BUG)
-> 
-> I would expect as the right behavior in step 7 user2 to be returned. But with a probability of ~50% we get user1 returned.
-> 
-> (Hint: If your got user1 try to destroy you IdP Session (e.g. close your browser) an redo Step 1. To 7. with user2 first)
-> 
-> 
-> Reason (Shibboleth 2.3.8):
-> AuthenticationEngine:747 contains a method mergeSubjects(...) which joins together the old and new subject in a HashSet.
-> As mergeSubjects(...) is a documented method, it dont seems like a bug by accident.
-> 
-> Question 1:
-> Is reauthentication against Shibboleth-IDP stable without PreviousSessionLoginHandler?
-> How can I ensure that the old session is destroy when relogin is successful?
-> 
-> Question 2:
-> How can I deactivate the SSO on per SP-basis?
-> 
-> 
-> Best Regards
->   Markus Burchhart
-> 
-> 
-> --
-> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
->