We have a web app that supports SSO (SAML 2.0) as well as traditional username/passwords. For the username/password scenario, we are using Form login without issues. For the SSO, we expose a REST API (/sso/login) that redirects users to IdP (suppose SessionId=1) and returns the response from IdP at /sso/asc (SessionId=2). Again no issues with SSO.
At this point, we'd like to authenticate the user by calling authenticationManager.authenicate(...).
How can we authenticate user of SessionId=1 and NOT SessionId=2