browser refresh problem?

[Gruber Bernhard SAI sIT]

I just came across this strange behavior:

1)      The service provider redirects to the shibboleth identity provider.
2)      The identity provider presents the login page.
3)      I click the refresh button in the browser.
4)      The identity provider sends a SAML-Response with urn:oasis:names:tc:SAML:2.0:status:AuthnFailed to the service provider.

Is this intended? Is browser refresh not supported?

During debugging I found out that AuthenticationEngine chooses completeAuthentication() while processing the refresh.
The service-method of the login servlet is never called during the refresh.

I use an External Authentication Login Handler, which forwards to my own login servlet actually doing the authentication.
        <ph:LoginHandler xsi:type="ph:ExternalAuthn" externalAuthnPath="/Authn/VerfuegerPassword"