session upgrade fails in combination with SAML-based SSO

1) Create an AuthChain 'datastoreService' with 'datastore' as required module
2) Create and AuthChain 'twofactor' with 'datastore' and 'HOTP' as required modules
3) Adopt AuthContexts of the IdP to map 'PasswordProtectedTransport' AuthContextClassRef to service 'datastoreService' and level '1'.
4) Adopt AuthContexts of the IdP to map 'TimeSyncToken' to service 'twofactor' and level '2'.
5) Authenticate at OpenAM with default auth chain of the realm where the CoT was created
6) Run SP-initiated SSO with AuthContextClassRef 'TimeSyncToken' on the Fedlet sample app

After submitting the OTP for the 2nd auth-module of the two factor chain, XUI responds with error Required callback not found in JSON response

Performing the same session upgrade without the SAML flow works fine.
i.e.
1) Authenticate at OpenAM with default auth chain
2) Authenticate with params &authIndexType=service&authIntexType=twofactor

Comparing the HTTP POST requests for the 'HOTP2' stage between does not show a significant difference, see attached excerpts from network capture.