[shibboleth Single TransientID Mapped to Multiple Principals]
Not packaged in Debian, separate package Shibboleth IdP
http://shibboleth.internet2.edu/secadv/secadv_20110113.txt
