3.2.x and Earlier Login Switching

[Klingenstein, Nate]

The class:

net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy

is referred to in your osu.authn.Duo implementation, but it looks like that was only implemented in 3.3.  I assume this is what you were referring to as part of the game playing with Principals, and a piece I can short-circuit with the assumptions I'm applying.

https://build.shibboleth.net/nexus/content/sites/site/java-identity-provider/3.2.1/apidocs/

https://build.shibboleth.net/jenkins/job/java-identity-provider-nightly/javadoc/net/shibboleth/idp/session/context/navigate/CanonicalUsernameLookupStrategy.html