random Subject after removing PreviousSessionLoginHandler

[Peter Schober]

* Burchhart Markus DEA sIT <Markus.Burchhart at s-itsolutions.at> [2013-01-10 15:35]:
> Reason (Shibboleth 2.3.8):
> AuthenticationEngine:747 contains a method mergeSubjects(...) which
> joins together the old and new subject in a HashSet.
> As mergeSubjects(...) is a documented method, it dont seems like a bug by accident.

More of an unfortunate design.
Did you check the archives (possibly user's list)? I'm sure there's
more on that.

> Question 1:
> Is reauthentication against Shibboleth-IDP stable without PreviousSessionLoginHandler?
> How can I ensure that the old session is destroy when relogin is successful?

Sharing an HTTP user agent with an active session at the IdP between
several distinct subjects is not supported, AFAIR.
It does not depend on disabling previous session, that just makes it
more obvious. And it's not a question of stability either.

> Question 2:
> How can I deactivate the SSO on per SP-basis?

I don't think there's anything for that in the sense you want.
Of course the SP can request forced authentication (and verify that it
happened in the response) but that won't give you "user switching"
within a single user agent any more than disabling the previous
session handler, IMHO.

* Kevin P. Foote <kpfoote at iup.edu> [2013-01-10 15:45]:
> Markus - Just curious is there a custom login handler involved here?

Doesn't need to be for that to happen,
-peter