MFA fails canonicalization of 2nd factor when re-using existing session

[Cantor, Scott]

So, this isn't working the way I thought, and after I looked into this to improve it, I verified that if you have two UsernamePrincipals with the same name in them, you should be fine, the Subject will track them as Sets and will only store off one of them. So the simple c14n flow should work fine for this.

Given that, you have a problem in your c14n of the individual names out of the Password and SPNEGO flow. If you expect them to match, apparently they don't. If you want to solve this "simply", just make sure they match.

Otherwise, you're stuck customizing things and I don't think you'd want to have to go down that road. Seems unnecessary here.

-- Scott