IdP initiated SSO

I'd like to use IdP initated SSO with Nextcloud. The reason for this is that we have different servers/URLs for different customers and those should all be able to access Nextcloud.

Steps to reproduce

1. Do NOT go to Nextcloud
2. POST a SAML response to /index.php/apps/user_saml/saml/acs

Expected behaviour

I'd like the user to be logged in to Nextcloud, whatever the state of the user previously was (not logged in, logged in, expired session).

Problems and my fixes

Normally you'd get "null" as a response.
Fix: comment out the following lines in assertionConsumerService, so it looks like this:

                // if(is_null($AuthNRequestID) || $AuthNRequestID === '') {
                //       return;
                // }

Then, logging in works. However, when you perform the SAML login again, you get an error "The user is already logged in" (or something like that). This is fixed by commenting out:

// @OnlyUnauthenticatedUsers

The code now looks like this:

         /**
         * @PublicPage
         * @NoCSRFRequired
         * @UseSession
         * // @OnlyUnauthenticatedUsers
         * @NoSameSiteCookieRequired
         *
         * @return Http\RedirectResponse|void
         */
        public function assertionConsumerService() {
                $AuthNRequestID = $this->session->get('user_saml.AuthNRequestID');
                // if(is_null($AuthNRequestID) || $AuthNRequestID === '') {
                //       return;
                // }

This seems to work fine, however I sometimes get an internal error, with in the logs:

Doctrine\DBAL\Exception\UniqueConstraintViolationException: An exception occurred while executing 'INSERT INTO "oc_authtoken"("uid","login_name","name","token","type","remember","last_activity","last_check") VALUES(?,?,?,?,?,?,?,?)' with params ["<SNIP>", "<SNIP>", "<SNIP>", "<SNIP>", 0, 0, 1523868098, 1523868098]: SQLSTATE[23505]: Unique violation: 7 ERROR: duplicate key value violates unique constraint "authtoken_token_index" DETAIL: Key (token)=(<SNIP>) already exists.

I expect this has to do with an expired session.

Questions

Now my actual question: is this a good way to add IdP initiated login to the user_saml plugin? Any security implications? How should I handle the expired session?

When I've got everything figured out, would you be interested in me adding a "Allow IdP initiated SSO" setting?

Start at the assertionConsumerService() entry point in the user_saml plugin and review how the AuthNRequestID session value and @OnlyUnauthenticatedUsers are handled. Reproduce IdP-initiated login and the expired-session case using the reported /index.php/apps/user_saml/saml/acs endpoint, then verify the duplicate authtoken error and define secure behavior for repeated logins. Done means IdP-initiated SSO works with a setting and without the reported session or security problems.