nameID mixup in IDP session

[Cantor, Scott]

> The mixup is done in AuthenticationEngine.mergeSubjects() which puts
> together both principals in one subject
> and  AbstractSAML2ProfileHandler. populateUserInformation() which takes
> out the name of the first principal from the subject.
> The subject stores the principals in a HashSet with undefined order by
> design.

Yes.

> By the way, the LoginContext contains the correct user information in its
> authenticationMethodInformation.

Yes, because it's transactional, not session-oriented. There's no history there.

> Is there a known secure way to use SSO and more than one authentication
> method?

I think it has more to do with multiple *users* than methods, but the basic answer is, write your own login handler as a super-structure for your own logic and bypass the existing SSO semantics and session behavior. I did a good deal of that in my own code, which is available from the contributions page.
 
The V3 design is explicitly fixing all of this by requiring every method to produce a canonical principal name that will enable configurable behavior for user switching events. This is probably my highest priority design issue.

-- Scott