Shibboleth sessions are restored on next login after logging out

[ybnd]

Describe the bug
Impossible to log in via username/password after logging out of a Shibboleth session

• The _shibsession_* cookie remains even after logging in
• Upon the next password login this cookie is used instead of the username/password, causing the previous Shibboleth user to get logged in again instead of the new password user.

To Reproduce
Steps to reproduce the behavior:

1. Log in via Shibboleth
   • You should see a _shibsession_* cookie in your browser's dev tools
2. Log out
   • The _shibsession_* cookie remains
3. Log in via password (as a different EPerson)
   • You will be logged in as the previous "Shibboleth EPerson" instead
   • It's impossible to log in as a "password user" until the session cookie is manually cleared

Expected behavior
Shibboleth sessions should not bleed over into the next "password session"

Preliminary investigation

Confirmed that this issue cannot be addressed from the frontend, as the _shibsession_* cookie is HttpOnly. We may be able to solve this by explicitly ignoring the cookie in REST if a login attempt is being made with username/password.

Related work
Discovered while working on DSpace/dspace-angular#1805

[tdonohue]

@ybnd : I think another way to approach this would be to address #7799

I see we actually have an old PR to address this from @paulo-graca : #2758 But it looks to have been abandoned. Maybe it's time to look at whether Single Logout for Shibboleth makes sense?

[chgoe]

We ran into the same issue. If I understand correctly, this appears to be caused by the AuthenticationService attempting each AuthenticationMethod retrieved through getAuthenticationMethodStack. This AM Stack appears to be built through getPluginSequence, its docstring states that:
"The order of the plugins in the array is the same as their class"

I tried changing the order of the AuthenticationMethods in local.cfg (commenting out other occurances in authentication.cfg), hoping that PasswordAuthentication will be attempted before ShibAuthentication, so that it now looks like this:
plugin.sequence.org.dspace.authenticate.AuthenticationMethod = org.dspace.authenticate.PasswordAuthentication
plugin.sequence.org.dspace.authenticate.AuthenticationMethod = org.dspace.authenticate.ShibAuthentication

This appears to have solved the issue for us.