In case of session upgrade the SAML IDPCache can lose the ssotoken sessionindex mapping

1) Login using SP initiated SSO (using default ldapService == DataStore REQ)
2) Login using regular UI with different service (Login?service=test == LDAP REQ)
3) Try to repeat 1)

The IDP session is null error message occurs, because in 2) a new ssotoken is issued, and that will cause the IDPCache to lose the original sessionindex<->ssotoken mapping, and the new session will not be mapped to the sessionindex.

Workarounds:

• openam.auth.destroy_session_after_upgrade=false
• custom SessionPropertyUpgrader implementation not copying the SAML index -> could cause problems, if the SAML application sends further requests (like isPassive=true)