IDP 2.4 finding session that should not exist

[Ted Fisher]

Our IDP v 2.4.0 is set to use CAS as RemoteUser authentication Handler.  So, normally every authnRequest results in a redirect to our CAS server for a new ST.  But, we have one Relying Party that after logout is done goes back to a landing page that attempts to authenticate again.  When it does our IDP is sending a response back without ever redirecting to our IDP. Logs show that the session had ended, but it somehow identified the user without redirecting to CAS:

08:48:06.858 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:497] - Authenticating user with login handler of type edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler
08:48:06.861 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler:66] - Redirecting to https://webapp.bgsu.edu:443/idp/Authn/RemoteUser
08:48:06.876 - TRACE [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:117] - Attempting to retrieve IdP session cookie.
08:48:06.877 - TRACE [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:123] - Found IdP session cookie.
08:48:06.877 - DEBUG [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:180] - No session associated with session ID 01b823cb83146029cc86c9bffdb6a27e38d6b65c14b7c7d8004042b397822e45 - session must have timed out
08:48:06.878 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserAuthServlet:73] - Remote user identified as jdunn returning control back to authentication engine

Can anyone suggest how it is determining a user without engaging the authentication handler?

(and yes we are in the process of upgrading our old 2.4.0 IDP)

Thanks

Ted F. Fisher
Information Technology Services