code: private void preventAttributeReuse(HttpServletRequest httpRequest, String principal) {
      try {
        SessionContext sessionCtx = sessionContextLookupStrategy.apply(this.getProfileRequestContext(httpRequest));
        if (sessionCtx == null || sessionCtx.getIdPSession() == null) {
          return;
        }
        if (principal.equals(sessionCtx.getIdPSession().getPrincipalName())) {
          logger.debug("Resetting IdP session '{}' in order to avoid re-use of attributes from previous session for user '{}'",
            sessionCtx.getIdPSession().getId(), principal);
  
          try {
            sessionManager.destroySession(sessionCtx.getIdPSession().getId(), true);
          }
          catch (SessionException e) {
            logger.error("Error destroying session {}", sessionCtx.getIdPSession().getId(), e);
          }
          sessionCtx.setIdPSession(null);
  
          AuthenticationContext authenticationContext = authenticationContextLookupStrategy.apply(this.getProfileRequestContext(httpRequest));
          authenticationContext.setActiveResults(Collections.<AuthenticationResult> emptyList());
        }
      }
      catch (Exception e) {
        logger.error("Exception while checking IdP session", e);
        return;
      }
    }
docs: By default, Shibboleth will try to avoid doing attribute resolving if there is a previous active session for the
  current user. We never want that since we are an external authentication method that want to tell <b>exactly</b>
  which attributes that are to be released each time. This method will take care of this.
  
  @param httpRequest
  the HTTP request
  @param principal
  the principal