Shiboleth logout problem

[Gruber Bernhard SAI sIT]

I came across this strange behavior during testing the logout feature of shibboleth:
I was using the new SLOProfilehandler triggered by the SAML Logout Protocol.

1. The User opens URL of ServiceProvider1 in Browser1 and successfully logs in, entering his credentials on shibboleth identity provider.
2. The User opens URL of ServiceProvider2 in Browser2 and successfully logs in, entering the same credentials on shibboleth identity provider.
Now the User has two distinct IDP-Sessions on the identity provider indexed by the same NameID.
There was no Single Sign On because the IDP-Session cookie was not shared between the browsers.
3. The User initiates logout from ServiceProvider1 in Browser1. The ServiceProvider1 sends a LogoutRequest to shibboleth identity provider and the logout succeeds.
4. The User initiates logout from ServiceProvider2 in Browser2. The ServiceProvider2 sends a LogoutRequest to shibboleth identity provider, but the logout fails.
The StatusCode was "urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal".
During debugging, I saw that the first logout removed all indices to the first session including the NameID-index.
During the second logout there was no index to the second session with this NameID-index.

To me it looks like only one Session can be indexed by a given NameID.
So if a user logs in independently from different Browsers from different Workstations, he will have different sessions on the IDP but only one of them is indexed by his NameID.
And he will only be able to log out form one of these sessions.