Single-sign-on does not select active user when ActiveDirectoryId is not unique