nameID mixup in IDP session

[Gruber Bernhard SAI sIT]

We have the requirement to provide different authentication methods on the IDP.
The authentication methods differ in the security level.

But if I have more than one authenticated user in one session, Shibboleth tends to confuse the user names.

Reproduce:
1)      Send SAML AuthnRequest to IDP
2)      On IDP login as user1 with low secure authentication method
3)      Send SAML AuthnRequest with ForceAuthn=true to IDP
4)      On IDP login as user2 with high secure authentication method

You can get user1 with high secure authentication method in der SAML Assertion.

The mixup is done in AuthenticationEngine.mergeSubjects() which puts together both principals in one subject
and  AbstractSAML2ProfileHandler. populateUserInformation() which takes out the name of the first principal from the subject.
The subject stores the principals in a HashSet with undefined order by design.

By the way, the LoginContext contains the correct user information in its authenticationMethodInformation.

Is there a known secure way to use SSO and more than one authentication method?