3.2.x and Earlier Login Switching

[Klingenstein, Nate]

This'll be obvious to most, but for the record:

a)  Java Principals are an actual kind of object rather than just a string "principal"
b)  The authnContext / authentication context in the IdP is not an AuthnContext in a SAML sense
c)  The bean name being the same as the flow name e.g.

    <action-state id="ValidateDuoWebResponse">
        <evaluate expression="ValidateDuoWebResponse" />

doesn't make them the same.

If I could just black box this, I would do as was done here:

https://github.com/carleton/duo_shibboleth/tree/master/v3/DuoShibboleth/src/main/java/com/duosecurity/integrations

as linked to from the Contributions:

https://wiki.shibboleth.net/confluence/display/IDP30/Contributions+and+Extensions